Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter "special".

[tuando243]

Add Doctor info payload to Doctor Special of Add Doctor page to target /admin-panel1.php, then use burpsuite get requests datas, change the 'special' parameter to xss payload: <script>alert(123)</script>
Step to exploit:

1. Navigate to http://hospital.com/admin-panel1.php
2. Click 'Add Doctors ', use burpsuite to insert xss payload in the "special" parameter
3. Click "Add Doctors"

Proof of concept (Poc)：

<script>alert(123)</script>