This vulnerability (CVE-2024-7016) in Smarttek Informatics Smart Doctor is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It allows an attacker with administrative privileges to inject malicious scripts that persist within the application, potentially impacting confidentiality and integrity. The vulnerability affects all versions through 21.11.2024. No vendor response or patch has been provided, and no known exploits are reported in the wild. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required high privileges, required user interaction, and a scope change with limited confidentiality and integrity impact but no availability impact.

Successful exploitation requires administrative privileges and user interaction, which limits the attack surface. The impact includes limited confidentiality and integrity loss due to script execution in the context of the application. There is no impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should restrict administrative access to trusted personnel only and monitor for unusual administrative activity. Avoid clicking on suspicious links or content within the administrative interface. Follow up with the vendor for any updates or patches.