A Cross-Site Scripting vulnerability in the edoc-doctor-appointment-system allows authenticated administrators to execute malicious scripts, posing a significant risk to session integrity.

This is a Cross-Site Scripting (XSS) flaw occurring in the admin/add-session.php file. The vulnerability is triggered via the title parameter and requires the attacker to possess administrative privileges (authenticated) to successfully inject and execute malicious scripts.

The exploitation of this vulnerability could lead to the compromise of administrative sessions, potentially allowing an attacker to manipulate appointment data or gain unauthorized control over the application interface. Given the CVSS score of 8.8, this flaw represents a High severity risk that could result in significant operational disruption and loss of data confidentiality for healthcare appointment records.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected administrative functions and audit existing session titles for suspicious scripts.

Proactive Monitoring: Review web access logs for unusual requests directed at admin/add-session.php and monitor for anomalies in administrative user activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious payloads containing script tags or event handlers within the title parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the research documentation provided in the vulnerability references.

Due to the high CVSS score and the confirmed existence of a public proof-of-concept, users of the edoc-doctor-appointment-system must treat this vulnerability with urgency. We recommend isolating the administrative interface and implementing strict input validation or WAF rules to prevent script injection until a vendor-supplied update is available.