SourceCodester Doctor Appointment System allows remote code execution via email input

Summary

The SourceCodester Doctor Appointment System 1.0 has a weakness that allows an attacker to execute malicious code remotely by manipulating the email address input on the Sign Up page. This creates a risk of unauthorized access and malicious activity. Update the system as soon as possible to protect against potential attacks.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
remyandrade	doctor_appointment_system	1.0	–

Original title

A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php of the component Sign Up Page. Executi...

Original description

A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php of the component Sign Up Page. Executing a manipulation of the argument Email can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

nvd CVSS2.0 5.0

nvd CVSS3.1 6.1

nvd CVSS4.0 5.3

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

CWE-94 Code Injection

https://github.com/rayficom/Proof-of-Concept/blob/main/20260219/README.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.348053 Permissions Required VDB Entry
https://vuldb.com/?id.348053 Third Party Advisory VDB Entry
https://vuldb.com/?submit.762427 Third Party Advisory VDB Entry
https://www.sourcecodester.com/ Product