Headline
CVE-2022-25407: Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter doctor. · Issue #21 · kishan0725/Hospital-Management-System
Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php.
Add Doctor info payload to Doctor Name of Add Doctor page to target /admin-panel1.php ,then use burpsuite get requests datas,change the ‘doctor’ parameter to xss payload: <sCrIpT>alert(1234)</ScRiPt>
Add Doctor info payload to Doctor Name of Add Doctor page to target /admin-panel1.php ,then use burpsuite get requests datas,change the ‘doctor’ parameter to xss payload: <sCrIpT>alert(1234)</ScRiPt>
Proof of concept (Poc)：
<sCrIpT>alert(1234)</ScRiPt>