CVE-2025-45805
BaseFortify
Publication date: 2025-09-03
Last updated on: 2025-12-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phpgurukul | doctor_appointment_management_system | 1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Doctor Appointment Management System 1.0 by phpgurukul. An authenticated doctor user can inject arbitrary JavaScript code into their profile name or employee ID fields. This malicious script is stored on the server and later executed without proper sanitization when a patient visits the doctor's profile to book an appointment, causing the script to run in the patient's browser. [1]
How can this vulnerability impact me? :
The vulnerability can have a high impact, allowing attackers to perform actions such as account takeover, session hijacking, or cookie theft. Since the malicious script runs in the victim's browser, it can compromise user accounts and sensitive session information, potentially leading to unauthorized access and data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying if arbitrary JavaScript code can be injected into doctor profile fields such as the name or employee ID and is executed when viewing the booking page. You can test this by logging in as an authenticated doctor user and attempting to insert a benign JavaScript payload (e.g., <script>alert('XSS')</script>) into the profile name or employee ID fields, then visiting the booking page as a patient to see if the script executes. Network detection tools may not directly detect this stored XSS, so manual or automated web application security testing tools (like OWASP ZAP or Burp Suite) should be used to scan for stored XSS vulnerabilities in these input fields. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing and validating all user inputs on the server side, especially the doctor profile fields such as name and employee ID, to prevent injection of arbitrary JavaScript code. Implement proper output encoding when rendering these fields in the web pages to ensure scripts are not executed. Additionally, restrict the ability to input HTML or script tags in profile fields and consider applying Web Application Firewall (WAF) rules to block suspicious payloads. Promptly update or patch the Doctor Appointment Management System to a version that fixes this vulnerability once available. [1]