PT-2022-22583 · Unknown · Clinic'S Patient Management System

Zhangzhaoyue · Published 2022-08-17 · Updated 2024-09-07 · CVE-2022-35117

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Clinic's Patient Management System version 1.0

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Packing text box under the Update Medical Details module, specifically via the update medicine details.php endpoint.

Recommendations For Clinic's Patient Management System version 1.0, consider disabling the Update Medical Details module until a patch is available to prevent exploitation of the XSS vulnerability via the update medicine details.php endpoint. Restrict access to the Packing text box to minimize the risk of arbitrary web script or HTML execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-35117

Affected Products

Clinic'S Patient Management System

References · 4

• 🔥 https://github.com/zhangzhaoyuela/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/xss-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-35117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35117 · Security Note
• https://t.me/cibsecurity/48296 · Telegram Post