CodeAstro Simple Hospital Management System Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in CodeAstro Simple Hospital Management System version 1.0. The issue resides in the POST parameter handler of the '/patient.html' file, where multiple parameters may be affected. This vulnerability allows attackers to inject malicious JavaScript that is permanently stored in the database and executed when the patient's profile page is accessed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, inject a script into the 'patname' field via a POST request. The injected script will be executed whenever the profile page is viewed.