PT-2024-27761 · Unknown · Codeprojects Health Care Hospital Management System

Himanshu Bindra · Published 2024-06-18 · Updated 2025-03-18 · CVE-2024-37803

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeProjects Health Care hospital Management System version 1.0

Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname and lname parameters under the Staff Info page. This is a result of multiple stored cross-site scripting (XSS) vulnerabilities.

Recommendations For CodeProjects Health Care hospital Management System version 1.0, consider restricting access to the Staff Info page until a patch is available. As a temporary workaround, avoid using the fname and lname parameters in the affected page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37803

Affected Products

Codeprojects Health Care Hospital Management System

References · 7

• 🔥 https://github.com/himanshubindra/CVEs/blob/main/CVE-2024-37803 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37803 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37803 · Vendor Advisory
• https://code-projects.org/health-care-hospital-in-php-css-js-and-mysql-free-download · Note
• https://t.me/cvenotify/86234 · Telegram Post
• https://t.me/cvenotify/83653 · Telegram Post
• https://t.me/cvenotify/115282 · Telegram Post