CVE-2026-36324

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Doctor Appointment System version 1.0 [1]. The user registration functionality in register.php does not properly sanitize user-supplied input, allowing an attacker to inject arbitrary JavaScript. The injected payload is stored in the database and later rendered without output encoding in the administrative user management interface at admin/users.php [2].

Exploitation

An unauthenticated attacker can access the registration form at /register.php and insert a malicious JavaScript payload (e.g., `) into the first name, last name, or email fields. When an administrator views the user list on the Admin Dashboard at /admin/users.php`, the payload is executed in the administrator's browser context [2]. No user interaction or authentication is required to trigger the stored payload.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the administrator's session. This can lead to theft of session cookies, defacement, and potentially full administrative account takeover, compromising the confidentiality and integrity of the application [2]. The CVSS v3.1 score is 6.5 (Medium) due to network attack vector, low complexity, no privileges required, and no user interaction needed [2].

Mitigation

As of the publication date, no official patch has been released by SourceCodester. Users are advised to implement input validation and output encoding for all user-supplied data in the registration form and the admin user management interface. Consider applying a web application firewall (WAF) with XSS rules or filtering the affected fields manually until a fix is available [1][2].