Celk Sistemas Celk Saude Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Celk Sistemas Celk Saude version 3.1.252.1. This vulnerability allows remote attackers to inject arbitrary JavaScript code via the 'erro' parameter.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the application's homepage and log in with invalid credentials. The application will respond with an error message containing the 'erro' parameter. Intercept the response and manipulate the 'erro' parameter to include a script tag with JavaScript code, such as an alert. Once the request is sent, the injected script will execute in the browser.