## Description

Code Projects Hospital Information System 1.0 is vulnerable to Sotre Cross-Site Scripting (XSS)

</br>

**Exploit Title:** Hospital Information System V1.0 - Store XSS

**Exploit Author:** Ritesh Sahu

**Vendor Homepage:** https://code-projects.org/ 

**Software Link:** https://code-projects.org/hospital-information-system-in-php-with-source-code/

**Tested on:** Linux

## Steps to Reproduce

1.   Visit:- http://localhost/HIS/src/index/index.php
2.   Login with the admin user and password.
3.   Go to add user:- http://localhost/HIS/src/users/addUser.php
4.   Add a new user using [XSS Payloads](https://github.com/Mr-Secure-Code/Offensive-Payloads/blob/main/Cross-Site-Scripting-XSS-Payloads.txt).
5.   After Adding a new user logout admin user and login admin user.
6.   Go to add user:- http://localhost/HIS/src/users/addUser.php
7.   Now the XSS payload is working.