Milo2012

The ACL module contains a reflected cross-site scripting issue. This occurs when unencoded input is injected into inline script blocks via the `module id` parameter in the 'acl/index' or 'acl/acl' endpoints. An attacker can use this to execute JavaScript within authenticated sessions, potentially stealing non-HttpOnly session cookies or modifying ACL configuration.

Authenticated attackers can execute JavaScript by injecting payloads into the `searchEleNo` POST parameter of the 'application/index/search' endpoint. This occurs because the application fails to encode HTML attributes in auto-suggest.phtml, allowing the injection of event handlers that trigger upon DOM insertion. This can lead to the theft of patient data and non-HttpOnly session cookies.

A reflected cross-site scripting issue exists in the Application module's auto-suggest endpoint. The endpoint `application/index/search` echoes the `searchMode` POST parameter unencoded into a single-quoted onClick attribute. This allows an attacker to execute arbitrary JavaScript in the session of an authenticated user by inducing them to submit a specific payload, potentially leading to the theft of session cookies or the disclosure of patient data.

The Eye Exam (eye mag) module contains a stored cross-site scripting issue. This occurs when administrators inject JavaScript through unencoded titles in the `Eye defaults` list option. An attacker can store a crafted title via the 'edit list.php' endpoint that breaks out of a jQuery string in 'eye base.php', resulting in script execution within the session of any authenticated user who clicks Defaults.