Subhash Paudel

**Name of the Vulnerable Software and Affected Versions** Order Up Online Ordering System version 1.0 **Description** A SQL Injection flaw exists in the `/api/integrations/getintegrations` API endpoint of Order Up Online Ordering System 1.0. An unauthenticated attacker can exploit this issue by sending a crafted POST request containing malicious SQL code through the `store id` parameter. Successful exploitation allows unauthorized access to sensitive backend database data. **Recommendations** Order Up Online Ordering System version 1.0: Sanitize or validate the `store id` parameter in the `/api/integrations/getintegrations` endpoint to prevent SQL injection attacks.

Name of the Vulnerable Software and Affected Versions: CodeAstro Simple Hospital Management System version 1.0 Description: A problematic issue was found in the CodeAstro Simple Hospital Management System, affecting an unknown functionality of the file /doctor.html, specifically the POST Parameter Handler component. The manipulation of the `First Name`, `Last Name`, or `Address` arguments leads to cross-site scripting. This issue can be exploited remotely. Recommendations: For CodeAstro Simple Hospital Management System version 1.0, as a temporary workaround, consider restricting access to the /doctor.html file until a patch is available. Avoid using the `First Name`, `Last Name`, or `Address` parameters in the affected POST Parameter Handler component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Notes Sharing System version 1.0 Description: A critical issue was found in the PHPGurukul Online Notes Sharing System, affecting an unknown part of the file /Dashboard of the component Cookie Handler. The manipulation of the `sessionid` argument leads to SQL injection. It is possible to initiate the attack remotely. The issue may be exploited, and the provided attack payload appears to be characteristic of an SQL injection attack. Recommendations: For PHPGurukul Online Notes Sharing System version 1.0, as a temporary workaround, consider restricting access to the /Dashboard file until a patch is available. Avoid using the `sessionid` argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CodeAstro Online Movie Ticket Booking System version 1.0 Description: A problematic issue has been discovered, affecting an unknown part of the system, which leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been publicly disclosed. Recommendations: For CodeAstro Online Movie Ticket Booking System version 1.0, consider implementing proper validation and verification of requests to prevent cross-site request forgery attacks. As a temporary workaround, restrict access to sensitive operations that could be exploited through such attacks until a more comprehensive fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CodeAstro Patient Record Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /login.php. The manipulation of the `uname` argument leads to SQL injection. This issue can be exploited remotely. Recommendations: For CodeAstro Patient Record Management System version 1.0, consider restricting access to the /login.php file until a patch is available. As a temporary workaround, avoid using the `uname` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CodeAstro Simple Hospital Management System version 1.0 Description: A problematic issue exists due to cross-site scripting in an unknown functionality of the file `/patient.html` within the POST Parameter Handler component. The attack can be launched remotely, and the exploit has been publicly disclosed. Multiple parameters may be affected. Recommendations: CodeAstro Simple Hospital Management System version 1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: A vulnerability was found in the PHPGurukul Hospital Management System, affecting an unknown functionality of the file /doctor/manage-patient.php. The manipulation of the `Name` argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Recommendations: As a temporary workaround, consider disabling the functionality related to the `Name` argument in the /doctor/manage-patient.php file until a patch is available. Restrict access to the /doctor/manage-patient.php file to minimize the risk of exploitation. Avoid using the `Name` argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CodeAstro Patient Record Management System version 1.0 Description: A problematic issue was found, leading to cross-site request forgery. The manipulation can be launched remotely. Recommendations: For CodeAstro Patient Record Management System version 1.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: A critical issue has been found in the PHPGurukul Hospital Management System, affecting some unknown functionality of the file /doctor/search.php. The manipulation of the `searchdata` argument leads to SQL injection. This issue can be exploited remotely. Recommendations: For PHPGurukul Hospital Management System version 4.0, as a temporary workaround, consider restricting access to the /doctor/search.php file or disabling the search functionality until a patch is available. Avoid using the `searchdata` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: CodeAstro Patient Record Management System version 1.0 Description: A vulnerability was found in the CodeAstro Patient Record Management System. This issue affects some unknown processing of the component Generate New Report Page. The manipulation of the argument `Patient Name/Name` leads to cross-site scripting. The attack may be initiated remotely. Recommendations: For CodeAstro Patient Record Management System version 1.0, consider restricting access to the Generate New Report Page until a fix is available. As a temporary workaround, avoid using the `Patient Name/Name` argument in the affected component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Food Ordering System version 1.0 **Description** A cross-site scripting (XSS) vulnerability exists due to the manipulation of the `Restaurant Name/Address` argument within a POST request parameter handler. This affects an unknown function in the `/admin/store/edit/` file. The vulnerability allows for remote attacks. The exploit for this issue has been publicly disclosed. **Recommendations** CodeAstro Food Ordering System version 1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHPGurukul Hospital Management System version 4.0 **Description** A vulnerability was found in the PHPGurukul Hospital Management System. It has been classified as problematic and affects an unknown function of the file /doctor/edit-patient.php?editid=2 of the component POST Parameter Handler. The manipulation of the argument `patname` leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For PHPGurukul Hospital Management System version 4.0, consider disabling the `patname` argument in the /doctor/edit-patient.php endpoint until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the `patname` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.