| عنوان | projectworlds Advanced Library Management System 1 Improper Neutralization of Alternate XSS Syntax |
|---|
| الوصف | A stored cross-site scripting (XSS) vulnerability was identified in Advanced Library Management System V1.0. The issue occurs in the /edit_admin.php?admin_id=1 endpoint, where the firstname POST parameter is stored in the database and later rendered in the application without proper escaping. An authenticated attacker can inject malicious JavaScript (e.g., <script>alert(/XSS/)</script>), which will execute whenever the affected page is viewed. Successful exploitation could lead to session hijacking, account takeover, CSRF, or distribution of malicious content to other users. The root cause is insufficient input validation and missing context-aware output encoding. Recommended fixes include applying htmlspecialchars() for output, enforcing strict input validation, implementing a Content Security Policy (CSP), and sanitizing existing stored values. |
|---|
| المصدر | ⚠️ https://github.com/ChenGuangHuangHun/CVE/issues/2 |
|---|
| المستخدم | chenguang (UID 91178) |
|---|
| ارسال | 01/10/2025 08:25 AM (10 أشهر منذ) |
|---|
| الاعتدال | 07/10/2025 01:44 PM (6 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 327360 [projectworlds Advanced Library Management System 1.0 /edit_admin.php firstname البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|