SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php クロスサイトスクリプティング

The XSS vulnerability in Patients Waiting Area Queue Management System allows an attacker to inject arbitrary JavaScript code into the application's web pages. This can be exploited by crafting malicious URLs containing the injected script, which are then executed in the context of a user's browser when they visit the affected page. Successful exploitation could lead to an attacker stealing session cookies, redirecting users to phishing sites, or defacing the website. The remote nature of the vulnerability means an attacker doesn't need to be on the same network as the server to exploit it. Given the public availability of the exploit, the risk of exploitation is elevated.

Healthcare facilities and clinics using SourceCodester's Patients Waiting Area Queue Management System version 1.0 are at risk. Organizations with limited security expertise or those who haven't implemented robust input validation practices are particularly vulnerable. Shared hosting environments where multiple users share the same server resources are also at increased risk.

• php / web:

curl -I 'http://your-target-domain.com/patient-search.php?FirstName=<script>alert(1)</script>&LastName='

• generic web:

 grep -i '<script' /var/log/apache2/access.log

1. 2026-02-25Disclosure

   disclosure

1. 予約済み2026-02-24
2. 公開日2026-02-25
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-3170 is to upgrade to a patched version of the Patients Waiting Area Queue Management System as soon as it becomes available from SourceCodester. Until a patch is released, consider implementing input validation and sanitization on the First Name/Last Name fields in /patient-search.php to prevent the injection of malicious scripts. Web application firewalls (WAFs) can be configured to filter out potentially malicious requests containing XSS payloads. Regularly review and update security policies to ensure they address XSS vulnerabilities.