PT-2021-17394
CVE-2021-27318
·
تاريخ النشر
2021-03-01
·
تاريخ التحديث
2021-03-08
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Doctor Appointment System version 1.0
Description
The issue allows remote attackers to inject arbitrary web script or HTML via the
lastname parameter in the contactus.php file. This can be exploited through the "/contactus.php" endpoint.Recommendations
For Doctor Appointment System version 1.0, avoid using the
lastname parameter in the contactus.php file until the issue is resolved. As a temporary workaround, consider validating and sanitizing all user input to the lastname parameter to prevent malicious script injection. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾