Celk Sistemas Celk Saude HTML Injection Vulnerability

A HTML injection vulnerability exists in Celk Sistemas Celk Saude version 3.1.252.1. This vulnerability allows remote attackers to inject arbitrary HTML code through the 'erro' parameter.

Impact

Exploitation of this vulnerability allows for HTML injection, which could be used to manipulate the content displayed to users or to execute scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the application with invalid credentials. The application will respond with an error message that includes the 'erro' parameter. Intercept the response and modify the 'erro' parameter to include HTML content, such as a link. Once the modified request is sent, the injected HTML will be rendered in the browser. Clicking the link will execute a JavaScript alert, demonstrating successful injection and execution of script-based payloads.