CVE-2026-36324: Doctor Appointment System XSS Vulnerability

CVE-2026-36324 Overview

CVE-2026-36324 is a Cross-Site Scripting (XSS) vulnerability affecting SourceCodester Doctor Appointment System 1.0. The flaw resides in the user registration functionality implemented in register.php, which fails to properly sanitize user-supplied input. An attacker can inject malicious JavaScript through registration form fields. When the unsanitized input is rendered in a victim's browser, the script executes in the victim's session context. This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions within the application.

Affected Products

SourceCodester Doctor Appointment System 1.0
The vulnerable component is register.php in the user registration workflow
Deployments using the PHP and MySQL source code distribution

Discovery Timeline

2026-05-29 - CVE-2026-36324 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-36324

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-controlled input in the registration endpoint. The register.php script accepts form parameters during account creation and stores or reflects them without applying output encoding or input filtering. When the application later renders these values into HTML responses, the browser interprets injected payloads as executable script.

This is a reflected and potentially stored XSS condition, depending on how registration data is later displayed within the application. The scope is changed (S:C), meaning code executes beyond the initial vulnerable component and can affect other users such as administrators viewing registration data. Confidentiality and integrity impacts are limited to data accessible within the browser context, including cookies, tokens, and DOM content.

Root Cause

The root cause is missing input validation and output encoding on registration fields. The application does not apply functions such as htmlspecialchars() or context-aware encoding before reflecting user data into HTML responses. Combined with a permissive content rendering pipeline, this allows arbitrary HTML and JavaScript injection.

Attack Vector

An unauthenticated attacker submits a crafted payload through one of the registration form fields in register.php. The payload is delivered via a malicious link or a controlled registration submission. When a victim, typically an administrator reviewing registrations or another user encountering the reflected data, loads the affected page, the injected script executes under the application's origin.

The vulnerability mechanism involves embedding HTML script tags or event handler attributes into registration parameters. See the GitHub CVE Disclosure for the technical proof of concept and payload details.

Detection Methods for CVE-2026-36324

Indicators of Compromise

HTTP POST requests to register.php containing script tags, JavaScript URIs, or HTML event handler attributes such as onerror, onload, or onmouseover
Registration records in the database containing encoded or raw <script>, <img>, <svg>, or <iframe> markup in user profile fields
Outbound browser requests from administrator sessions to attacker-controlled domains shortly after viewing the registration interface

Detection Strategies

Inspect web server access logs for registration submissions containing URL-encoded angle brackets (%3C, %3E) or JavaScript keywords in form parameters
Deploy a Web Application Firewall (WAF) with XSS rule sets to identify and block script injection attempts targeting register.php
Perform code review and static analysis on PHP source files to identify unsanitized echo statements that render $_POST or $_GET data

Monitoring Recommendations

Monitor application logs for repeated failed registration attempts containing suspicious payload patterns
Track anomalous administrator session activity, including unexpected API calls or DOM modifications following access to the registrations page
Alert on Content Security Policy (CSP) violation reports if a CSP is deployed in report-only or enforcing mode

How to Mitigate CVE-2026-36324

Immediate Actions Required

Restrict public access to the Doctor Appointment System until input sanitization is applied to all registration parameters
Apply server-side input validation that rejects HTML metacharacters in fields such as name, email, and address
Implement output encoding using htmlspecialchars($input, ENT_QUOTES, 'UTF-8') on every reflected value
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

Patch Information

No official vendor patch is currently referenced in the NVD entry for CVE-2026-36324. Administrators must apply manual code remediation in register.php and any pages that render registration data. Refer to the SourceCodester project page for the latest source distribution and the CVE disclosure repository for remediation context.

Workarounds

Place the application behind a WAF configured with OWASP Core Rule Set XSS signatures to filter injection attempts
Disable or gate public user registration until source-level fixes are deployed
Enforce HTTP-only and Secure attributes on session cookies to reduce the impact of script-based session theft

bash

# Example PHP sanitization pattern for register.php
# Apply htmlspecialchars on every reflected registration field
$name    = htmlspecialchars(trim($_POST['name']    ?? ''), ENT_QUOTES, 'UTF-8');
$email   = htmlspecialchars(trim($_POST['email']   ?? ''), ENT_QUOTES, 'UTF-8');
$address = htmlspecialchars(trim($_POST['address'] ?? ''), ENT_QUOTES, 'UTF-8');

# Example Content Security Policy header to mitigate XSS
header("Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'");