CVE-2023-6423

Name of the Vulnerable Software and Affected Versions BigProf Online Clinic Management System version 2.2

Description A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the /clinic/events view.php endpoint, in the FirstRecord parameter. This could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Recommendations For BigProf Online Clinic Management System version 2.2, consider disabling access to the /clinic/events view.php endpoint or restricting the use of the FirstRecord parameter until a patch is available. Additionally, ensure proper input encoding to prevent XSS attacks.