PT-2022-15710 · Sourcecodtester Hospital · Patient Record Management System

Sant268 · Published 2022-01-26 · Updated 2022-02-02 · CVE-2022-22852

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodtester Hospital's Patient Records Management System version 1.0

Description A Stored Cross Site Scripting (XSS) issue exists via the description parameter in "room list". This allows for potential malicious script execution.

Recommendations For version 1.0, consider disabling the description parameter in the "room list" endpoint until a patch is available to prevent exploitation. Restrict access to the "room list" endpoint to minimize the risk of XSS attacks. Avoid using the description parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22852

Affected Products

Patient Record Management System

References · 6

• 🔥 https://github.com/Sant268/CVE-2022-22852/blob/main/CVE-2022-22852.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-22852 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22852 · Vendor Advisory
• https://t.me/cvenotify/25871 · Telegram Post
• https://t.me/cibsecurity/36343 · Telegram Post
• https://sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html · Note