CVE-2025-5584
BaseFortify
Publication date: 2025-06-04
Last updated on: 2025-06-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anujk305 | hospital_management_system | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5584 is a stored Cross-Site Scripting (XSS) vulnerability in PHPGurukul Hospital Management System version 4.0. It occurs in the POST parameter 'patname' of the file /doctor/edit-patient.php. An attacker can inject malicious JavaScript code into this parameter, which is then stored in the system's database. When other users view the affected patient's profile page, the malicious script executes in their browsers, potentially allowing attackers to perform actions like session hijacking or defacement. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute arbitrary scripts in the context of your browser when viewing affected patient profiles. This can lead to session hijacking, defacement, or other malicious actions. Exploitation requires the attacker to have some authentication privileges and victim interaction, but the attack can be launched remotely. The integrity of data can be compromised due to injected malicious scripts. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the POST parameter "patname" in the /doctor/edit-patient.php file with the query parameter editid=2 for cross-site scripting (XSS) payloads. You can use tools like curl or Burp Suite to send crafted POST requests containing JavaScript code in the "patname" parameter and observe if the script is executed when viewing the patient's profile page. For example, a curl command to test might be: curl -X POST -d "patname=<script>alert('XSS')</script>" "http://target/doctor/edit-patient.php?editid=2" --cookie "session=your_auth_cookie" Note that authentication with sufficient privileges is required to access this functionality. Monitoring HTTP responses for reflected or stored script tags in the response HTML can help detect the vulnerability. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected functionality to trusted users only, applying input validation and output encoding on the "patname" parameter to neutralize malicious scripts, and considering replacing the affected PHPGurukul Hospital Management System version 4.0 with an alternative product. Since no known countermeasures or patches are currently identified, limiting user privileges and monitoring for suspicious activity are recommended until a fix is available. [2]