| عنوان | code-projects https://code-projects.org/simple-inventory-system-in-php-with-source-code/ 1.0 Cross Site Scripting |
|---|
| الوصف | The Simple Inventory System in PHP v1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the user registration functionality.
The vulnerability exists in the register.php endpoint, where the application processes user-supplied input during account registration. The last_name parameter accepts arbitrary user input and stores it in the application's backend database without performing adequate input validation or sanitization.
When the stored user information is later displayed within the administrative interface or other pages that list registered users, the application renders the value of the last_name field directly into the HTML response without applying proper output encoding. As a result, malicious HTML or JavaScript embedded in the stored value is interpreted and executed by the victim's browser.
An attacker can exploit this vulnerability by registering a new account and injecting a malicious JavaScript payload into the last_name parameter. For example, the following payload can be supplied:
<script>alert(1)</script>
After the registration request is processed, the payload is permanently stored in the application's database. Whenever an administrator or another authenticated user views the affected account through the user management interface or any page displaying the stored value, the injected JavaScript executes automatically in the context of the application.
The vulnerability is caused by the application's failure to properly sanitize user-controlled input before storing it and by the absence of contextual output encoding when rendering stored data. Because the malicious payload remains persistent in the database and is executed whenever the affected record is viewed, the issue is classified as a Stored (Persistent) Cross-Site Scripting (XSS) vulnerability.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of authenticated users. Depending on the privileges of the victim, this may enable session hijacking, theft of authentication cookies, execution of unauthorized actions, modification of application content, delivery of phishing interfaces, or compromise of administrator accounts. Since the payload persists within the application, multiple users may be affected until the malicious content is removed from the database. |
|---|
| المصدر | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Simple%20Inventory%20System%20PHP%20last_name%20Parameter.md |
|---|
| المستخدم | AhmadMarzook (UID 96211) |
|---|
| ارسال | 16/07/2026 10:56 PM (1 شهر منذ) |
|---|
| الاعتدال | 30/08/2026 10:12 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397125 [code-projects Simple Inventory System 1.0 User Registration /register.php last_name البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|