myCare2x contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'aktion' and 'callurl' parameters upon submission to the modules/patient/mycare2x_pat_info.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

OSVDB is not aware of a solution for this vulnerability.

• Exploit Database: 18844
• CVE ID: 2012-4262 (see also: NVD)
• Secunia Advisory ID: 49029
• Related OSVDB ID: 81684 81685 81686 81687 81688 81690
• Packet Storm: http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.html
• Other Advisory URL: http://www.vulnerability-lab.com/get_content.php?id=524

• the_storm - Vulnerability Research Laboratory
• Benjamin Kunz Mejri - Vulnerability Research Laboratory