The flaw is in Patients Waiting Area Queue Management System 1.0 and is triggered when a malicious value is supplied for the Reason parameter in the api_patient_schedule.php script. The vulnerable code reflects the parameter back to an HTML page without adequate sanitization, allowing an attacker to inject arbitrary HTML or JavaScript. The weakness is classified under common weaknesses that involve untrusted input rendering and improper command evaluation. Consequently, users who receive the page can have scripts executed in their browsers, leading to potential session hijacking, phishing, or defacement.

Affected vendors include Patrick Mvuma and SourceCodester for patients waiting area queue management systems. The vulnerability exists in version 1.0 of the software. No other versions or additional details are specified in the available documentation.

The CVSS score of 5.1 indicates medium severity, and the exploit is remote with no authentication requirement. The EPSS score is under 1 %, signifying a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalogue. Attackers can exploit the flaw by crafting a URL or API call that injects malicious scripts into the Reason parameter, which is then reflected in the response page.