CVE-2026-3170: Pamzey Queue Management System XSS Flaw

CVE-2026-3170 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in the Patients Waiting Area Queue Management System version 1.0 developed by SourceCodester/Patrick Mvuma (Pamzey). The vulnerability exists in the /patient-search.php file where the First Name and Last Name parameters are not properly sanitized before being reflected back to the user. This allows remote attackers with elevated privileges to inject malicious scripts that execute in the context of victim browsers.

Critical Impact

Attackers can inject and execute arbitrary JavaScript code in victim browsers, potentially leading to session hijacking, credential theft, defacement of the application, or delivery of malware to healthcare facility staff accessing the patient queue system.

Affected Products

• Pamzey Patients Waiting Area Queue Management System version 1.0
• SourceCodester Patients Waiting Area Queue Management System 1.0
• /patient-search.php component with First Name/Last Name input fields

Discovery Timeline

• 2026-02-25 - CVE-2026-3170 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-3170

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The affected application fails to properly validate and sanitize user-supplied input in the patient search functionality. When a user submits data through the First Name or Last Name fields on the /patient-search.php page, the application reflects this input back to the browser without adequate encoding or filtering.

The vulnerability requires privileged access (PR:H in the CVSS vector) and user interaction (UI:P) to exploit successfully, which limits the attack surface. However, in a healthcare environment, the potential for abuse remains significant as attackers could target administrative staff or other privileged users of the queue management system.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the /patient-search.php file. The application directly incorporates user-supplied values from the First Name and Last Name form fields into the HTML response without proper sanitization. This allows attackers to craft malicious input containing JavaScript code that will be executed when the page is rendered in a victim's browser.

Attack Vector

The attack is network-based and can be executed remotely. An attacker with elevated privileges in the application can exploit this vulnerability by:

1. Accessing the patient search functionality at /patient-search.php
2. Injecting malicious JavaScript code into the First Name or Last Name input fields
3. The malicious script is stored or reflected back to other users viewing the search results
4. When a victim views the affected page, the injected script executes in their browser context

The exploit has been publicly disclosed and a proof-of-concept is available. Technical details can be found in the GitHub Gist PoC Code and the VulDB entry #347677.

Detection Methods for CVE-2026-3170

Indicators of Compromise

• Unexpected JavaScript code or HTML tags appearing in the First Name or Last Name fields in application logs
• HTTP requests to /patient-search.php containing script tags, event handlers, or encoded JavaScript payloads
• User reports of unusual browser behavior or pop-ups when accessing the patient search functionality
• Web server logs showing requests with common XSS patterns such as <script>, javascript:, or encoded variants

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads targeting the /patient-search.php endpoint
• Monitor application logs for input containing HTML special characters or JavaScript-related strings in name fields
• Deploy Content Security Policy (CSP) headers and monitor for CSP violation reports
• Use browser-based XSS auditor logs if available in your environment

Monitoring Recommendations

• Enable detailed logging for all requests to /patient-search.php and review for suspicious patterns
• Configure alerts for requests containing typical XSS payload signatures targeting patient name fields
• Monitor for unusual user session behavior that may indicate session hijacking following XSS exploitation

How to Mitigate CVE-2026-3170

Immediate Actions Required

• Restrict access to the /patient-search.php functionality to only essential personnel until a patch is applied
• Implement input validation on the server side to reject or sanitize special characters in the First Name and Last Name fields
• Apply output encoding (HTML entity encoding) to all user-supplied data before rendering in HTML responses
• Deploy a Web Application Firewall with XSS protection rules in front of the application

Patch Information

No official vendor patch is currently available for this vulnerability. The application is developed by SourceCodester/Patrick Mvuma (Pamzey) and users should monitor the VulDB entry for updates on remediation. Organizations using this software should consider implementing the workarounds below or seeking an alternative queue management solution until the vulnerability is addressed.

Workarounds

• Implement server-side input validation to strip or encode HTML special characters from name fields
• Add Content Security Policy headers to prevent inline script execution: Content-Security-Policy: default-src 'self'; script-src 'self'
• Consider temporarily disabling the patient search functionality if it is not critical to operations
• Apply the principle of least privilege and limit access to the administrative functions where this vulnerability exists

# Configuration example - Apache .htaccess Content Security Policy
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>