CVE-2026-2149: Pamzey Queue Management System XSS Flaw

CVE-2026-2149 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in the Patients Waiting Area Queue Management System version 1.0, developed by SourceCodester/Patrick Mvuma (Pamzey). This vulnerability exists in the /appointments.php file and can be exploited through manipulation of the patient_id parameter. The attack can be launched remotely without authentication, and the exploit has been made publicly available.

Critical Impact

Attackers can inject malicious scripts through the patient_id parameter, potentially compromising user sessions, stealing sensitive healthcare data, or performing actions on behalf of authenticated users in this medical facility management application.

Affected Products

• Pamzey Patients Waiting Area Queue Management System 1.0
• SourceCodester Patients Waiting Area Queue Management System 1.0

Discovery Timeline

• 2026-02-08 - CVE-2026-2149 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2149

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The application fails to properly sanitize user-supplied input in the patient_id parameter within the /appointments.php endpoint before rendering it in the HTML response.

When a user submits or accesses appointment information, the patient_id value is reflected in the page output without adequate encoding or validation. This allows an attacker to craft malicious URLs or form submissions containing JavaScript payloads that execute in the context of a victim's browser session.

The vulnerability is particularly concerning in a healthcare context, as the Queue Management System likely handles sensitive patient information and medical appointment data. Successful exploitation could lead to unauthorized access to patient records, session hijacking of healthcare staff accounts, or defacement of the medical facility's patient management interface.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the /appointments.php file. The application directly incorporates user-controlled data from the patient_id parameter into the HTML response without sanitizing potentially dangerous characters such as <, >, ", ', and &. This lack of input validation allows attackers to inject arbitrary HTML and JavaScript content that the browser interprets as legitimate code.

Attack Vector

The attack is network-based and requires user interaction to execute successfully. An attacker can craft a malicious URL containing JavaScript payload in the patient_id parameter and deliver it to a victim through phishing emails, social engineering, or by embedding the link in another compromised website.

When an authenticated user (such as a hospital receptionist or medical staff) clicks the malicious link, the injected script executes within their browser session with full access to the application's context. This can enable:

• Session cookie theft leading to account takeover
• Keylogging of sensitive information entered into forms
• Modification of displayed patient data
• Redirection to malicious phishing pages
• Unauthorized actions performed on behalf of the victim

The vulnerability details and proof-of-concept information have been documented in external security resources. For technical details on the exploitation mechanism, refer to the GitHub XSS Vulnerability Overview.

Detection Methods for CVE-2026-2149

Indicators of Compromise

• Unusual HTTP requests to /appointments.php containing script tags, event handlers, or encoded JavaScript in the patient_id parameter
• Web server logs showing URL-encoded characters such as %3Cscript%3E, %22onclick%3D, or javascript: in request parameters
• Unexpected outbound connections from client browsers to external domains after accessing the appointments page
• User reports of strange behavior, pop-ups, or redirects when using the appointment management interface

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads in HTTP request parameters
• Configure intrusion detection systems to alert on requests containing HTML tags or JavaScript event handlers in the patient_id field
• Implement Content Security Policy (CSP) headers to restrict script execution and report policy violations
• Review application logs for anomalous patterns in the patient_id parameter values

Monitoring Recommendations

• Enable detailed logging for all requests to /appointments.php and regularly audit for suspicious parameter values
• Monitor for CSP violation reports which may indicate attempted XSS attacks
• Set up alerts for multiple failed or unusual requests originating from the same IP address targeting appointment-related endpoints
• Implement session monitoring to detect potential session hijacking following XSS exploitation attempts

How to Mitigate CVE-2026-2149

Immediate Actions Required

• Apply input validation to the patient_id parameter, ensuring only expected numeric or alphanumeric values are accepted
• Implement proper output encoding using context-appropriate escaping (HTML entity encoding) before rendering user-supplied data
• Deploy a Web Application Firewall with XSS detection rules as a temporary protective measure
• Consider temporarily restricting access to the application until a proper patch is available

Patch Information

No official vendor patch has been released at the time of this publication. Organizations using Patients Waiting Area Queue Management System 1.0 should monitor the vendor's official channels for security updates. Additional vulnerability information is available at VulDB #344851.

Workarounds

• Implement server-side input validation to accept only numeric values for the patient_id parameter
• Apply HTML entity encoding to all user-supplied output using PHP's htmlspecialchars() function with ENT_QUOTES flag
• Deploy Content Security Policy headers to prevent inline script execution: Content-Security-Policy: script-src 'self'
• Use a reverse proxy or WAF to filter malicious requests before they reach the application

# Apache .htaccess configuration to add basic CSP headers
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>