SourceCodester Patients Waiting Area Queue Management System Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester's Patients Waiting Area Queue Management System version 1.0. The issue resides in the file '/php/api_patient_schedule.php', where the 'Reason' argument can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely and has been made public.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a request to the '/php/api_patient_schedule.php' endpoint with a crafted 'Reason' argument that includes a script tag. The injected script will be executed when the reason is displayed on the dashboard.