# N/A
## 漏洞概述
PHPGurukul Hospital Management System 4.0 中存在多个跨站脚本（XSS）漏洞，影响了系统中的多个参数。这些漏洞存在于 `searchdata` 参数、`fromdate` 参数和 `todate` 参数中。
## 影响版本
- PHPGurukul Hospital Management System 4.0
## 漏洞细节
1. **searchdata 参数**
- 路径 `(a) doctor/search.php`
- 路径 `(b) admin/patient-search.php`
2. **fromdate 参数**
- 路径 `admin/betweendates-detailsreports.php`
3. **todate 参数**
- 路径 `admin/betweendates-detailsreports.php`
## 影响
这些XSS漏洞允许攻击者通过操纵上述参数注入恶意脚本，进而对用户执行恶意操作或窃取敏感信息。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/hospital-management-xss.yaml | POC详情 |
| 2 | Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in patient-search.php. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/hospital-management-xss2.yaml | POC详情 |
| 3 | Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php and patient-search.php. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39411.yaml | POC详情 |
暂无评论