PT-2025-3374 · Unknown · Phpgurukul Hospital Management System

Kirito999 · Published 2025-01-21 · Updated 2025-01-21 · CVE-2024-56997

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PHPGurukul Hospital Management System version 4.0

Description The issue concerns a Cross Site Scripting (XSS) vulnerability in the /doctor/index.php file, where an attacker can inject malicious code via the Email parameter. This allows for potential code execution and unauthorized access.

Recommendations For PHPGurukul Hospital Management System version 4.0, as a temporary workaround, consider restricting access to the /doctor/index.php file or disabling the Email parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56997

Affected Products

Phpgurukul Hospital Management System

References · 6

• 🔥 https://github.com/kirito999/HMS_stored_XSS/blob/main/stored%20XSS5%20in%20HMS4.0/stored%20XSS5%20in%20HMS.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56997 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56997 · Vendor Advisory
• https://twitter.com/CVEnew/status/1881715911326908637 · Twitter Post
• https://t.me/cvenotify/108033 · Telegram Post
• https://t.me/cvedetector/15973 · Telegram Post