Stored Cross Site Scripting Vulnerabilities in Hospital Management System Gurukul v4.0 #2

Multiple stored cross site scripting vulnerabilities are present in Hospital Management System Gurukul v4.0

In the add-patient.php file, several POST parameters are directly used into the INSERT SQL query without any kind of escaping or sanitization.

      /* ... */

if(isset($_POST['submit']))
{
    $docid=$_SESSION['id'];
    $patname=$_POST['patname'];
    $patcontact=$_POST['patcontact'];
    $patemail=$_POST['patemail'];
    $gender=$_POST['gender'];
    $pataddress=$_POST['pataddress'];
    $patage=$_POST['patage'];
    $medhis=$_POST['medhis'];
    $sql=mysqli_query($con,"insert into tblpatient(Docid,PatientName,PatientContno,PatientEmail,PatientGender,PatientAdd,PatientAge,PatientMedhis)
values('$docid','$patname','$patcontact','$patemail','$gender','$pataddress','$patage','$medhis')");

      /* ... */

In the admin/manage-patients.php, doctor/manage-patient.php, doctor/view-patient.php, admin/view-patient.php and view-medhistory.php files, the data that was inserted by the above-mentioned query is retrieved from the database and added to the current page.

      /* Example from doctor/view-patient.php*/

$vid=$_GET['viewid'];
$ret=mysqli_query($con,"select * from tblpatient where ID='$vid'");
$cnt=1;
while ($row=mysqli_fetch_array($ret)) {

    /* ... */
    echo $row['PatientName'];
    /* ... */
    echo $row['PatientEmail'];
    /* ... */
    echo $row['PatientContno'];
    /* ... */
    echo $row['PatientContno'];
    /* ... */
    echo $row['PatientAdd'];
    /* ... */
    echo $row['PatientGender'];
    /* ... */
    echo $row['PatientMedhis'];
    /* ... */
    echo $row['CreationDate'];
    /* ... */

The vulnerable parameters through which the attack can be carried out are patname, patemail, gender, pataddress and medhis POST parameters.
The following is one of the possible exploitation using the medhis POST parameter.

POST /hospitalmanagementsystemproject4/hospital/hms/doctor/add-patient.php HTTP/1.1
Host: localhost
Content-Length: 180
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="105", "Not)A;Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/hospitalmanagementsystemproject4/hospital/hms/doctor/add-patient.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=lrqh66ialqjgfot5rcq90bnvjj
Connection: close

patname=Name4&patcontact=3124432845&patemail=Name3%40mail.com&gender=male&pataddress=3021+Halsted+St%2C+Chicago&patage=40&medhis=[url-encoded-script]&submit=

An attacker can easily inject malicious Javascript into the database and steal session cookies from users and administrators.

These vulnerabilities were found by Riccardo Nannini using the CLAY project developed at SISL lab in UIC and have been assigned CVE-2022-42205.