Executive brief
A vulnerability exists in the Hospital's Patient Records Management System, a software used to manage medical patient data. An attacker can inject malicious scripts into the 'Remarks' field of a patient record, which could lead to the theft of administrative session tokens or unauthorized actions being performed in the context of an administrator's browser. This could compromise the privacy of patient records and the integrity of the management system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Hospital's Patient Records Management System 1.0 within the '/admin/?page=patients/view_patient' endpoint. The root cause is the failure of the application to properly sanitize or encode the 'remarks' parameter before rendering it in the web interface. An attacker with sufficient privileges to modify patient records can inject malicious JavaScript. When an administrative user views the affected patient record, the script executes in their browser, potentially allowing for session hijacking via cookie theft or unauthorized administrative actions. While the advisory mentions 'no login required' in one section, the CVSS metrics and file path suggest an administrative context (PR:H).
Affected products
- SourceCodester Hospital's Patient Records Management System 1.0
Timeline
- 2026-04-29: disclosed: Initial disclosure on GitHub issues
- 2026-05-26: advisory: NVD publication date