CVE-2021-39411

MEDIUMNuclei

Hospital Management System 1.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-39411 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHHospital Management System 1.0 - Cross-Site ScriptingCVSS 7.2

Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php and patient-search.php.

Impact

Authenticated attackers can inject malicious JavaScript via XSS in the searchdata parameter, potentially stealing session cookies or performing unauthorized administrative actions.

Remediation

Apply security patches or upgrade to Hospital Management System version 1.1 or later.

WeaknessesCWE-79
Authorsarafatansari
Template tagscvecve2021hmshospitalcmsxssauthenticatedvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:phptpoint:hospital_management_system:*:*:*:*:*:*:*:*
Shodan: http.html:"Hospital Management System"
https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-39411&scoretype=cvssv3 https://nvd.nist.gov/vuln/detail/CVE-2021-39411

Source: ProjectDiscovery

References

2