Hospital Management System Cross-Site Scripting Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities have been identified in Hospital Management System version 4. These vulnerabilities reside in the 'func2.php' file, where the 'fname' and 'lname' parameters are not properly sanitized. This lack of sanitation allows remote attackers to inject and execute arbitrary scripts in the context of the victim's browser.

Impact

Exploitation of these vulnerabilities allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the Hospital Management System and navigate to a feature that utilizes the 'func2.php' file. Inject a script into the 'fname' or 'lname' parameters. The absence of proper input validation will allow the script to execute, demonstrating the cross-site scripting vulnerability.