Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Doctor Appointment Management System 1.0 by phpgurukul. An authenticated doctor user can inject arbitrary JavaScript code into their profile name or employee ID fields. This malicious script is stored on the server and later executed without proper sanitization when a patient visits the doctor's profile to book an appointment, causing the script to run in the patient's browser. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a high impact, allowing attackers to perform actions such as account takeover, session hijacking, or cookie theft. Since the malicious script runs in the victim's browser, it can compromise user accounts and sensitive session information, potentially leading to unauthorized access and data breaches. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves verifying if arbitrary JavaScript code can be injected into doctor profile fields such as the name or employee ID and is executed when viewing the booking page. You can test this by logging in as an authenticated doctor user and attempting to insert a benign JavaScript payload (e.g., <script>alert('XSS')</script>) into the profile name or employee ID fields, then visiting the booking page as a patient to see if the script executes. Network detection tools may not directly detect this stored XSS, so manual or automated web application security testing tools (like OWASP ZAP or Burp Suite) should be used to scan for stored XSS vulnerabilities in these input fields. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and validating all user inputs on the server side, especially the doctor profile fields such as name and employee ID, to prevent injection of arbitrary JavaScript code. Implement proper output encoding when rendering these fields in the web pages to ensure scripts are not executed. Additionally, restrict the ability to input HTML or script tags in profile fields and consider applying Web Application Firewall (WAF) rules to block suspicious payloads. Promptly update or patch the Doctor Appointment Management System to a version that fixes this vulnerability once available. [1]

Useful 0 Not Useful 0