CVE-2026-2154: Pamzey Queue Management System XSS Flaw

CVE-2026-2154 Overview

A stored Cross-Site Scripting (XSS) vulnerability has been identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System version 1.0. The vulnerability exists in the Patient Registration Module, specifically within the /registration.php file. An attacker can exploit this flaw by manipulating the "First Name" argument to inject malicious scripts that execute in the context of other users' browsers. The exploit is publicly available, increasing the risk of active exploitation against unpatched systems.

Critical Impact

This stored XSS vulnerability allows remote attackers to inject persistent malicious scripts through the patient registration form, potentially compromising healthcare staff credentials, stealing session tokens, or redirecting users to malicious sites within a medical facility environment.

Affected Products

• Pamzey Patients Waiting Area Queue Management System 1.0
• SourceCodester Patients Waiting Area Queue Management System 1.0

Discovery Timeline

• 2026-02-08 - CVE-2026-2154 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2154

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). The application fails to properly sanitize user-supplied input in the "First Name" field during patient registration, allowing attackers to inject malicious JavaScript code that becomes permanently stored in the application's database.

When healthcare staff or administrators subsequently view patient records containing the malicious payload, the injected script executes within their browser session. This stored nature of the XSS makes it particularly dangerous as it affects all users who access the compromised patient record, without requiring any additional attacker interaction after the initial injection.

The attack requires network access to the vulnerable application and some user interaction (viewing the poisoned record), but no authentication is required for the initial injection through the registration form.

Root Cause

The root cause is insufficient input validation and output encoding in the Patient Registration Module. The /registration.php file directly processes and stores user input from the "First Name" field without sanitizing HTML special characters or implementing proper output encoding when displaying the stored data. This allows HTML and JavaScript code to be interpreted by the browser rather than being displayed as plain text.

Attack Vector

The attack is conducted remotely over the network. An unauthenticated attacker submits a patient registration form with malicious JavaScript embedded in the "First Name" field. The payload is stored in the backend database and executed whenever the patient record is viewed by healthcare staff, administrators, or other users with access to patient data.

The attack flow involves injecting script tags or event handlers within the First Name input field during patient registration. Once stored, any user viewing that patient's information will have the malicious script execute in their browser context, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

Detection Methods for CVE-2026-2154

Indicators of Compromise

• Presence of HTML tags or JavaScript code in patient name fields within the database (e.g., <script>, <img onerror=, javascript:)
• Unusual network requests originating from the queue management application to external domains
• User reports of unexpected pop-ups, redirects, or behavior anomalies when viewing patient records
• Web application logs showing registration requests with encoded or suspicious characters in name fields

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS patterns in POST requests to /registration.php
• Deploy database monitoring to alert on patient records containing HTML tags or script elements in name fields
• Configure browser Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Enable detailed application logging to capture and analyze registration form submissions

Monitoring Recommendations

• Monitor web server access logs for POST requests to /registration.php with suspicious payload patterns
• Set up alerts for any JavaScript execution attempts from patient data display pages
• Review stored patient data periodically for signs of script injection
• Implement real-time log analysis for XSS signature detection in input fields

How to Mitigate CVE-2026-2154

Immediate Actions Required

• Remove or restrict access to the Patients Waiting Area Queue Management System until patched
• Audit existing patient records in the database for signs of injected malicious content
• Implement input validation on the "First Name" field to allow only alphanumeric characters and common name characters
• Apply output encoding (HTML entity encoding) when displaying patient names in the application

Patch Information

No official patch has been released by the vendor at this time. Organizations should contact SourceCodester/Patrick Mvuma or the maintainer (pamzey) for security updates. The vulnerability details are documented in the Medium XSS Vulnerability Report and tracked in VulDB #344856.

Workarounds

• Implement server-side input validation to strip or reject HTML/JavaScript content in all form fields
• Apply HTML entity encoding on all user-supplied data before rendering in web pages
• Deploy a Web Application Firewall (WAF) with XSS protection rules in front of the application
• Restrict access to the patient registration functionality to authenticated users only
• Consider using a Content Security Policy (CSP) header to prevent inline script execution

# Example Apache configuration to add Content-Security-Policy header
# Add to .htaccess or Apache virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"

# Example input sanitization in PHP (apply to registration.php)
# $firstName = htmlspecialchars($_POST['first_name'], ENT_QUOTES, 'UTF-8');