Cross-Site Scripting Vulnerability in CodeAstro Hospital Management System

CVE-2024-11677

What is CVE-2024-11677?

CVE-2024-11677 reveals a cross-site scripting (XSS) vulnerability in the CodeAstro Hospital Management System 1.0, specifically affecting the 'Add Vendor Details' page located at '/backend/admin/his_admin_add_vendor.php'. The vulnerability stems from improper handling of user input parameters such as v_name, v_adr, v_number, v_email, v_phone, and v_desc. Malicious actors can exploit this flaw remotely to inject and execute arbitrary scripts in the context of the user’s browser. This poses a significant risk for data exposure and user account hijacking, as the exploit has been publicly disclosed, emphasizing the need for immediate security measures and patching by users of the affected product.

References