PT-2022-26311 · Unknown · Phpgurukul Hospital Management System

Riccardo Nannini · Published 2022-10-21 · Updated 2025-05-08 · CVE-2022-42205

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Hospital Management System version 4.0

Description The issue concerns a Cross Site Scripting (XSS) flaw. This type of flaw occurs when an application includes user input in its output without proper validation or encoding, allowing an attacker to inject malicious content, such as scripts. In this case, the vulnerability is present in the add-patient.php file.

Recommendations For PHPGurukul Hospital Management System version 4.0, consider validating and encoding all user input in the add-patient.php file to prevent XSS attacks. As a temporary workaround, restrict access to the add-patient.php file until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-42205

Affected Products

Phpgurukul Hospital Management System

References · 4

• 🔥 https://sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-hms2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42205 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42205 · Vendor Advisory
• https://t.me/cvenotify/121355 · Telegram Post