PT-2023-32655 · Unknown · Bigprof Online Clinic Management System

Rafael Pedrero · Published 2023-11-30 · Updated 2026-02-06 · CVE-2023-6425

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BigProf Online Clinic Management System version 2.2

Description A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/clinic/medical records view.php" API endpoint, in the FirstRecord parameter. Exploitation of this issue could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Recommendations For BigProf Online Clinic Management System version 2.2, consider disabling the /clinic/medical records view.php endpoint or restricting access to the FirstRecord parameter until a patch is available. Additionally, ensure proper encoding of user-controlled input to prevent XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6425

Affected Products

Bigprof Online Clinic Management System

References · 7

• https://osv.dev/vulnerability/CVE-2023-6425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6425 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products · Note
• https://twitter.com/VulmonFeeds/status/1730251982802161851 · Twitter Post
• https://t.me/cveNotify/151167 · Telegram Post
• https://exploit-db.com/exploits/51439 · Note
• https://twitter.com/CVEnew/status/1730228878751215642 · Twitter Post