Cross-Site Scripting in Hospital Information System 1.0

Executive Summary

CVE-2026-86301 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Hospital Information System (HIS) 1.0. It affects the patient editing function in the file /HIS/src/patients/editPatient.php. The vulnerability occurs because the 'id' parameter is not properly validated or sanitized, allowing attackers to inject malicious JavaScript code via a crafted URL. When the victim accesses the link, the injected script executes in their browser within the HIS application context.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability, inspect HTTP requests to /HIS/src/patients/editPatient.php with the id parameter. Look for responses reflecting unsanitized input like <script>alert(1)</script>. Use browser developer tools or tools like Burp Suite to capture and analyze requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to execute unauthorized actions, manipulate data, or perform phishing attacks on users of the Hospital Information System. Since the attack requires an authenticated user to access the crafted request, it primarily affects users with valid system access who unknowingly click on malicious links.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to breaches of patient data confidentiality, which may violate GDPR and HIPAA requirements for protecting sensitive health information. Unauthorized script execution could enable data theft or manipulation, resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately validate the id parameter as an integer on the server side. Implement strict output encoding for all user-controlled data. Add Content Security Policy headers to restrict script execution. Ensure database queries use prepared statements to prevent injection.

Useful 0 Not Useful 0