CVE-2025-45805
📋 TL;DR
CVE-2025-45805 is a stored cross-site scripting (XSS) vulnerability in phpgurukul Doctor Appointment Management System 1.0. Authenticated doctor users can inject malicious JavaScript into their profile name, which executes when other users view the doctor's profile to book appointments. This affects all users of the vulnerable system.
💻 Affected Systems
- phpgurukul Doctor Appointment Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform account takeovers, redirect users to malicious sites, or deploy malware through the application.
Likely Case
Session hijacking, credential theft, and unauthorized actions performed as authenticated users.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only minor UI disruption.
🎯 Exploit Status
Multiple public PoCs available on GitHub. Requires doctor-level authentication but trivial to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql
Restart Required: No
Instructions:
No official patch available. Implement input validation and output encoding as workaround.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to sanitize doctor profile name input
Edit PHP files handling doctor profile updates to filter/escape special characters
Implement Output Encoding
allEncode user-controlled data before rendering in HTML context
Use htmlspecialchars() or similar functions when outputting doctor names
🧯 If You Can't Patch
- Restrict doctor account creation and monitor existing doctor accounts
- Implement web application firewall (WAF) rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
As authenticated doctor, attempt to inject <script>alert('XSS')</script> into profile name and check if it executes when viewing profile.Check Version:
Check system version in admin panel or about pageVerify Fix Applied:
Test that script tags and other HTML/JavaScript payloads are properly escaped in profile display.📡 Detection & Monitoring
Log Indicators:
- Unusual doctor profile name updates containing script tags or JavaScript code
- Multiple failed login attempts followed by profile updates
Network Indicators:
- HTTP requests with script payloads in POST parameters
- Unusual outbound connections from application server
SIEM Query:
source="web_logs" AND (uri="/update-profile.php" OR uri="/doctor-profile.php") AND (message="*<script>*" OR message="*javascript:*")