Executive brief
A security vulnerability exists in the PHPGurukul Hospital Management System, a platform used for managing medical facility operations. An attacker with a patient account can inject malicious code into their profile name, which then runs in the browser of a doctor who views the patient's appointment history. This could allow an attacker to steal a doctor's login session, potentially leading to unauthorized access to sensitive medical records and administrative functions.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in PHPGurukul Hospital Management System v4.0 within the /hospital/hms/edit-profile.php component. The application fails to properly sanitize the 'User Name' parameter before storing it in the database. An authenticated attacker (patient) can inject a malicious JavaScript payload that is subsequently executed in the context of a doctor's browser session when they view the /hospital/hms/doctor/appointment-history.php page. Successful exploitation allows the attacker to capture the doctor's session cookies via an external listener (e.g., Burp Collaborator), enabling session hijacking and full account takeover of medical staff accounts.
Affected products
- PHPGurukul Hospital Management System 4.0
Timeline
- 2026-02: disclosed: Discovered by Raneisha Justin
- 2026-05-07: advisory: NVD Published Date