Vulnerable Version: Hospital Management System 1.0
Vulnerability Description
Stored Cross-Site Scripting (XSS) is a serious web vulnerability that allows malicious code to be injected into a website, stored in the database, and later executed when other users view the infected page. In this specific case, the vulnerability is found in the user login page of a Hospital Management System (HMS), where the "Fullname" parameter is susceptible to stored XSS attacks. The lack of proper input validation and data sanitization allows an attacker to inject malicious scripts, potentially compromising user accounts, stealing sensitive information, or performing unauthorized actions.
Steps to Reproduce (PoC)
Clone the Repository:
root@kitploit:~
git clone https://github.com/sharathc213/CVE-2023-7172.git
cd CVE-2023-7172
Run Docker Compose:
root@kitploit:~
docker-compose up -d
Access the User Registration Form:
Open a web browser and navigate to the user registration form at http://localhost:8080/hms/registration.php
Fill in the Registration Form:
Input the following payload in the "Fullname" field:
Complete the other required fields with valid information.
Submit the Registration Form:
Click the "Submit" button to send the registration data to the server.
Check for Successful Registration:
Receive a successful registration confirmation message.
Login with the Registered Email:
Navigate to the login page at http://localhost:8080/hms/user-login.php.
Enter the Registered Email:
In the login form, enter the email address used for registration.
Log In:
Submit the login form by clicking the "Log In" button.
Observing the XSS Payload:
Upon successful login, the XSS payload should trigger an alert box displaying the user's cookies, indicating the existence of the Stored XSS vulnerability.
Impact of Stored XSS in a Hospital Management System
A Stored XSS vulnerability in a Hospital Management System can have severe consequences, including:
Patient Data Exposure:
Potential theft of sensitive patient data for identity theft or fraud.
Patient Safety Risks:
Unauthorized changes in patient records could jeopardize patient safety.
Unauthorized Actions:
Attacker could execute actions on behalf of users, leading to unauthorized access and potential misuse.
Trust Erosion:
Harm to the reputation of the healthcare facility due to breached trust.
Regulatory Non-Compliance:
Violation of data protection regulations, resulting in fines and legal consequences.
Disruption of Healthcare Services:
Possible disruptions in patient care, prescription errors, or misdiagnoses with severe health implications.
Legal and Ethical Implications:
Legal liability for any harm caused, along with ethical concerns about patient privacy.
Financial Consequences:
Costs associated with remedying the breach, including investigations, system upgrades, and legal expenses.
Mitigation Recommendations
To address this vulnerability, implement the following mitigation measures:
Input Validation and Sanitization:
Implement strict input validation and data sanitization routines to ensure that user-generated content is free from malicious code. This includes validating data on both the client and server sides.
Disclaimer
This project is intentionally vulnerable and should only be used for educational and testing purposes. Do not deploy this in a production environment.
sharathc213/cve-2023-7173
