CVE-2023-6422

Name of the Vulnerable Software and Affected Versions BigProf Online Clinic Management System version 2.2

Description A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the /clinic/patients view.php API endpoint, in the FirstRecord parameter. Exploitation of this issue could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Recommendations For BigProf Online Clinic Management System version 2.2, consider disabling the FirstRecord parameter in the /clinic/patients view.php API endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of storing malicious JavaScript payloads.