Executive brief
A Hospital Information System used to manage patient records contains a reflected cross-site scripting (XSS) vulnerability in the patient edit functionality. An attacker can craft a malicious link that, when clicked by a hospital staff member, executes arbitrary JavaScript in their browser session, potentially allowing theft of session credentials, patient data manipulation, or unauthorized actions on behalf of the authenticated user.
Technical details
The vulnerability is a reflected XSS flaw in the /HIS/src/patients/editPatient.php file, specifically in the handling of the ID parameter. The vulnerable component fails to properly validate and encode user-supplied input before reflecting it in the HTTP response. An unauthenticated attacker can send a specially crafted URL with malicious JavaScript payload in the ID parameter to a hospital staff member. When the victim opens the link in their authenticated session, the JavaScript executes in their browser context. No authentication is required from the attacker; only the victim must be logged in and click the malicious link.
Affected products
- code-projects Hospital Information System 1.0
Timeline
- 2026-09-07: disclosed: Vulnerability published