Executive brief
A vulnerability exists in the itsourcecode Hospital Management System, a software platform used for managing medical facility operations. An attacker can exploit this flaw to execute malicious scripts in the web browser of a legitimate user, such as a hospital administrator. This could lead to unauthorized actions, the theft of sensitive session cookies, or the redirection of staff to fraudulent websites.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in itsourcecode Hospital Management System 1.0. The issue is located in the /billing.php component, where the 'patientid' URL parameter is reflected into the page output without sufficient sanitization or encoding. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized data access. A public exploit has been disclosed.
Affected products
- itsourcecode Hospital Management System 1.0
Timeline
- 2026-05-23: disclosed: Vulnerability reported on GitHub by ltranquility
- 2026-06-08: advisory: CVE-2026-11512 published by VulDB/NVD