Headline
CVE-2022-25493: Reflected XSS attack in treatmentrecord.php · Discussion #10 · kabirkhyrul/HMS
HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php.
poc
An unauthenticated malicious user can take advantage of a Reflected XSS vulnerability in the treatmentrecord.php.
/treatmentrecord.php?patientid=noname%27><script>alert(1)</script>
analysis
treatmentrecord.php line178 without any filter.
