CVE-2021-39416 Cross-site scripting in n/a
Multiple XSS vulnerabilities in Remote Clinic allow attackers to inject malicious scripts via various input fields, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-39416?
CVE-2021-39416 is a medium-severity cross-site scripting vulnerability in n/a, published on 5 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters.
Weakness: CWE-79
Which versions are affected by CVE-2021-39416?
It affects 1 product.
Products include Remoteclinic Remote Clinic.
How do I fix CVE-2021-39416?
No fix has been published for CVE-2021-39416 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-39416 being exploited?
There is no known exploitation of CVE-2021-39416 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-62g8-f48c-frqp.