CVE-2020-35705 in Daybyday
Summary
by MITRE • 12/25/2020
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in Daybyday version 2.1.0 represents a critical stored cross-site scripting flaw that fundamentally compromises user security through improper input validation mechanisms. This weakness specifically manifests within the New User screen where the Name parameter fails to adequately sanitize user-supplied data before storage and subsequent rendering. The vulnerability enables attackers to inject malicious javascript code that persists in the application's database and executes whenever affected users view the stored content, creating a persistent threat vector that can affect multiple users over time.
The technical implementation of this flaw demonstrates a classic failure in input sanitization and output encoding practices that directly violates established security principles outlined in the CWE (Common Weakness Enumeration) catalog under CWE-79 which specifically addresses cross-site scripting vulnerabilities. The vulnerability operates at the application layer where user inputs are not properly validated or escaped before being stored in the backend database, allowing malicious payloads to be permanently embedded within the system's data store. This stored nature of the vulnerability distinguishes it from reflected XSS attacks and makes it particularly dangerous as the malicious code executes automatically for any user who encounters the compromised data.
The operational impact of this vulnerability extends beyond simple data theft or defacement, creating a persistent threat that can be leveraged for session hijacking, credential theft, or redirection to malicious sites. Attackers can craft payloads that steal cookies, modify user permissions, or redirect victims to phishing pages that appear legitimate within the Daybyday application context. The stored nature means that even if the initial injection occurs during user registration, the malicious code continues to execute for all future users who encounter the compromised data, making this vulnerability particularly insidious and difficult to contain once exploited. This type of vulnerability aligns with ATT&CK technique T1531 which focuses on manipulation of external-facing applications, as it exploits a weakness in an application's user management interface.
Security mitigation strategies must address both immediate remediation and long-term prevention through comprehensive input validation, output encoding, and proper sanitization mechanisms. The most effective approach involves implementing strict validation of all user inputs including the Name parameter, employing context-appropriate output encoding for all stored data, and implementing Content Security Policy headers to limit the execution scope of injected scripts. Additionally, regular security testing including automated scanning and manual penetration testing should be implemented to identify similar vulnerabilities throughout the application codebase. The fix must ensure that all user-supplied data undergoes proper sanitization before database storage and that rendered outputs properly escape special characters to prevent script execution in the browser context.