Hospital-Management-System icon indicating copy to clipboard operation
Hospital-Management-System copied to clipboard

Published 20 hours ago • verified publisher icon kishan0725

Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter "special".

Open tuando243 opened this issue 2 years ago • 0 comments

Add Doctor info payload to Doctor Special of Add Doctor page to target /admin-panel1.php, then use burpsuite get requests datas, change the 'special' parameter to xss payload: Step to exploit:

  1. Navigate to http://hospital.com/admin-panel1.php
  2. Click 'Add Doctors ', use burpsuite to insert xss payload in the "special" parameter
  3. Click "Add Doctors"

Screenshot 2022-03-29 at 16 34 01

Screenshot 2022-03-29 at 16 34 32

Proof of concept (Poc)：

tuando243 avatar Mar 29 '22 09:03 tuando243