Description

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-07T12:17:21.680Z",
  "pubdate": "2026-09-07T12:17:21.680Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Hospital Information System 1.0, specifically within the patient management component. This vulnerability allows remote, unauthenticated attackers to inject malicious scripts into the application via the ID parameter in the /HIS/src/patients/editPatient.php file. Successful exploitation enables the execution of arbitrary JavaScript in the context of the victim's browser session. This poses a significant security risk, potentially leading to unauthorized session hijacking, theft of sensitive patient data, and account compromise. The vulnerability is publicly disclosed, increasing the likelihood of active exploitation. Organizations utilizing this version of the Hospital Information System should treat this as a high-priority risk and implement immediate defensive measures to sanitize input and prevent script execution.",
  "technicalDetails": "The vulnerability is a classic reflected Cross-Site Scripting (XSS) flaw located in the /HIS/src/patients/editPatient.php script of the Hospital Information System 1.0. The root cause is the failure of the application to properly sanitize or validate the 'ID' parameter before rendering it in the resulting HTML document returned to the user's browser.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload within the ID parameter. Because the application fails to perform adequate output encoding or context-aware validation, the script is injected directly into the document object model (DOM). When a victim clicks the malicious link or is redirected to the crafted URL, the browser interprets the input as legitimate executable code rather than plain text.\nThe exploitation method relies on the server reflecting the unsanitized input back to the user within an HTTP response. As the victim's browser processes the response, it executes the embedded JavaScript. Since this occurs within the origin of the vulnerable application, the attacker's script gains access to sensitive data, including session cookies, local storage, and the ability to perform actions on behalf of the authenticated user within the Hospital Information System interface.\nThe component affected is the Patient Management module, which handles the retrieval and display of patient records. The lack of input normalization allows for the bypass of rudimentary filters, assuming any exist, by using common XSS vectors or encoding techniques. The attack does not require prior authentication to launch, as the vulnerability resides within a page that processes user-supplied parameters directly.\nThe post-exploitation impact is severe. An attacker could perform a 'session hijack' by capturing the user's session token and transmitting it to a remote server under the attacker's control. Furthermore, the attacker could manipulate the Patient Management interface to modify or delete sensitive medical records, perform unauthorized actions, or redirect the user to malicious sites, compromising both the integrity and confidentiality of the patient data processed by the Hospital Information System."
}