Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter dpassword.

[fuzzyap1]

Add Doctor info payload to Doctor Name of Add Doctor page to target /admin-panel1.php ,then use burpsuite get requests datas,change the 'dpassword' parameter to xss payload: <sCrIpT>alert(7777)</ScRiPt>
Steps to exploit:

1. Navigate to http://hospital.com/admin-panel1.php

2. click 'Add Doctors ', use burpsuite to insert xss payload in the "dpassword" parameter

3. Click "Add Doctors"

Proof of concept (Poc)：

<sCrIpT>alert(7777)</ScRiPt>