A stored XSS vulnerability in OpenReception appointment booking software allows an authenticated attacker to escalate privileges or compromise user sessions.

The software suffers from improper input neutralization, enabling stored cross-site scripting (XSS). This requires an authenticated user with high privileges to trigger the vulnerability, potentially impacting other users or administrators within the platform.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of other users, which can lead to session hijacking, unauthorized data access, or administrative actions performed on behalf of the victim. This poses a significant threat to the security and integrity of the appointment booking platform.

Immediate Action: Update the OpenReception appointment booking software to version 1.0.2 or later to resolve the input validation flaw.

Proactive Monitoring: Audit application logs for suspicious user activity, particularly involving the injection of script-like tags into booking fields.

Compensating Controls: Use a Content Security Policy (CSP) to mitigate the impact of XSS vulnerabilities by restricting the sources from which scripts can be executed.

Public Exploit Available: Unknown.

The presence of a proof-of-concept makes this a credible threat despite the requirement for authentication. Administrators should prioritize the update to version 1.0.2 to ensure the XSS vector is properly neutralized and to prevent potential session compromise.