Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-6425. PoCs published by Rafael Pedrero.
AI-analyzed exploit summary The exploit demonstrates multiple stored and reflected XSS vulnerabilities in Online Clinic Management System 2.2 via the 'FirstRecord' parameter in various PHP scripts. The PoC includes both GET and POST request examples with payloads that trigger JavaScript alerts.
Description
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/medical_records_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
Exploits (1)
The exploit demonstrates multiple stored and reflected XSS vulnerabilities in Online Clinic Management System 2.2 via the 'FirstRecord' parameter in various PHP scripts. The PoC includes both GET and POST request examples with payloads that trigger JavaScript alerts.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L