| عنوان | PHPGurukul Cyber Cafe Management System Using PHP & MySQL 1.0 Cross Site Scripting |
|---|
| الوصف | A fundamental web security principle is that all untrusted input must be validated and properly encoded before being included in HTML responses to prevent client-side code execution. However, during the security review it was found that search.php directly echoes the searchdata POST parameter into the page (<h4 align="center">Result against "<?php echo $sdata;?>" keyword </h4>) without any output encoding or sanitization, allowing an attacker to inject HTML/JavaScript that will execute in the context of a victim’s browser. Successful exploitation of this reflected XSS can lead to session cookie theft (if cookies lack HttpOnly), forced actions on behalf of authenticated users, theft of sensitive information visible in the browser, and other client-side attacks that may escalate to account takeover or further lateral misuse. This unchecked reflection substantially increases the application’s attack surface and risk to user confidentiality and trust. |
|---|
| المصدر | ⚠️ https://github.com/r4vindra/Cyber-Cafe-Management-System/blob/main/README.md |
|---|
| المستخدم | r4vindra (UID 91109) |
|---|
| ارسال | 29/09/2025 05:12 PM (1 سنة منذ) |
|---|
| الاعتدال | 13/10/2025 06:52 PM (14 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 327317 [PHPGurukul Cyber Cafe Management System 1.0 POST Parameter /search.php searchdata البرمجة عبر المواقع] |
|---|
| السبب | Vendor source not identifiable. Please reply with website of the responsible vendor. |
|---|
| النقاط | 0 |
|---|