PT-2022-23259 · Unknown · Doctor Appointment System

Published 2022-08-31 · Updated 2022-09-06 · CVE-2022-36203

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Doctor's Appointment System version 1.0

Description The issue allows for Cross Site Scripting (XSS) via the admin panel, which can lead to the takeover of the administrator account by stealing the cookie via XSS.

Recommendations For Doctor's Appointment System version 1.0, consider disabling access to the admin panel until a fix is available to prevent potential XSS attacks and subsequent administrator account takeovers. Restrict the use of sensitive features within the admin panel to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36203

Affected Products

Doctor Appointment System

References · 6

• 🔥 https://github.com/aznull/CVEs · Exploit
• 🔥 http://packetstormsecurity.com/files/168211/Doctors-Appointment-System-1.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-36203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36203 · Security Note
• https://sourcecodester.com/hashenudara/simple-doctors-appointment-project.html · Note
• https://t.me/cvenotify/35559 · Telegram Post