PT-2024-15446 · Unknown · Phpgurukul Hospital Management System

Adarsh C + 1 · Published 2024-01-07 · Updated 2024-05-17 · CVE-2024-0286

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Hospital Management System version 1.0

Description A problematic vulnerability was found in the PHPGurukul Hospital Management System, affecting an unknown part of the file index.php#contact us of the component Contact Form. The manipulation of the arguments Name, Email, and Message leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For PHPGurukul Hospital Management System version 1.0, consider disabling the Contact Form component until a patch is available to prevent cross-site scripting attacks. Restrict access to the index.php#contact us file to minimize the risk of exploitation. Avoid using the arguments Name, Email, and Message in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0286

Affected Products

Phpgurukul Hospital Management System

References · 9

• 🔥 https://drive.google.com/file/d/1MkVtMe63h5TlZvcC_Hc1fn6dn-jwNR8l/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2024-0286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0286 · Security Note
• https://twitter.com/VulmonFeeds/status/1744078414951088252 · Twitter Post
• https://twitter.com/CVEnew/status/1744050860920066141 · Twitter Post
• https://vuldb.com/?id.249843 · Note
• https://t.me/cvenotify/66537 · Telegram Post
• https://vuldb.com/?ctiid.249843 · Note
• https://t.me/cvenotify/67073 · Telegram Post