myCare2x contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'name_last', 'name_first', 'name_middle', and 'name_maiden' parameters upon submission to the modules/patient/mycare_pid.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

OSVDB is not aware of a solution for this vulnerability.

• Exploit Database: 18844
• CVE ID: 2012-4262 (see also: NVD)
• Secunia Advisory ID: 49029
• Related OSVDB ID: 81684 81685 81686 81688 81689 81690
• Packet Storm: http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.html
• Other Advisory URL: http://www.vulnerability-lab.com/get_content.php?id=524

• the_storm - Vulnerability Research Laboratory
• Benjamin Kunz Mejri - Vulnerability Research Laboratory