A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /backend/admin/his_admin_add_lab_equipment.php of the component Add Laboratory Equipment Page. The manipulation of the argument eqp_code/eqp_name/eqp_vendor/eqp_desc/eqp_dept/eqp_status/eqp_qty leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://codeastro.com/ | Product |
| https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md | Exploit Mitigation Third Party Advisory |
| https://vuldb.com/?ctiid.286016 | Permissions Required |
| https://vuldb.com/?id.286016 | Permissions Required |
| https://www.youtube.com/watch?v=UsScmd8Xzuw | Exploit |
Configurations
Configuration 1 (hide)
|
History
04 Dec 2024, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hospital Management System Project hospital Management System
Hospital Management System Project |
|
| CPE | cpe:2.3:a:hospital_management_system_project:hospital_management_system:1.0:*:*:*:*:*:*:* | |
| References | () https://codeastro.com/ - Product | |
| References | () https://github.com/EmilGallajov/zero-day/blob/main/codeastro_hms_stored_xss.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.286016 - Permissions Required | |
| References | () https://vuldb.com/?id.286016 - Permissions Required | |
| References | () https://www.youtube.com/watch?v=UsScmd8Xzuw - Exploit |
26 Nov 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-26 01:15
Updated : 2024-12-04 20:19
NVD link : CVE-2024-11676
Mitre link : CVE-2024-11676
CVE.ORG link : CVE-2024-11676
JSON object : View
Products Affected
hospital_management_system_project
- hospital_management_system