Stored script execution via unsanitized patient fields

Stored XSS in CodeAstro Hospital Management System 1.0 allows remote authenticated users to execute script in an administrator's browser. The his_admin_register_patient.php handler stores nine unvalidated POST fields directly in patient records, allowing supplied markup to return later as page content. Exploitation requires access to the Add Patient Details page and a later record view; the resulting script can read application data or act within that browser session.