Loading vulnerability…
Stored XSS in Imaster Patient Record Management System edit_patient.php (firstname)
Imaster's Patient Record Management System is vulnerable to stored cross-site scripting (XSS) in the administrative endpoint /projects/hospital/admin/edit_patient.php. An attacker can inject malicious JavaScript into the firstname parameter such that the payload is stored server-side and subsequently rendered without proper output encoding. The stored script executes in a victim’s browser whenever the patient list is viewed, enabling arbitrary JavaScript execution in the context of the application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Arbitrary JavaScript execution in the victim user’s browser when accessing the patient list, which can enable session hijacking, credential theft, UI redress, and performing unauthorized actions as the victim within the application context.
If you can’t patch tonight, do this now.
Restrict access to /projects/hospital/admin/edit_patient.php to trusted users/networks; add strict server-side validation/sanitization for firstname; ensure output encoding in the patient list view; deploy a restrictive Content Security Policy (CSP) to reduce script execution impact; and implement WAF rules to detect/block common XSS payloads targeting the affected endpoint.
Patch, then assume compromise.
Correct input handling and output rendering for user-controlled fields: implement robust server-side validation and sanitization for firstname (and similar fields), and apply context-appropriate output encoding when rendering patient data in the patient list and related views. Apply a vendor-provided patch/fixed release when available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.