CVE-2023-36159 in Lost and Found Information System
Summary
by MITRE • 08/04/2023
Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/12/2026
This cross site scripting vulnerability exists within the Lost and Found Information System version 1.0 developed by sourcecodester. The flaw manifests in the user registration process where the application fails to properly sanitize input data submitted through the First Name, Middle Name, and Last Name fields. When an attacker submits malicious script code within these fields during user creation, the system stores this unvalidated input without adequate encoding or filtering mechanisms. This vulnerability falls under the CWE-79 category of Cross Site Scripting, specifically representing a stored XSS attack vector where malicious payloads are persistently stored on the server and executed whenever the affected data is rendered to other users. The vulnerability enables attackers to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, credential theft, or redirection to malicious websites.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with a foothold for more sophisticated attacks within the application's environment. When legitimate users view user profiles containing the malicious payloads, their browsers execute the injected scripts, creating potential for credential harvesting through form grabbing techniques or session manipulation. The attack chain typically begins with an attacker registering a new user account with malicious input in the name fields, followed by other users accessing these profiles, which triggers the execution of the stored scripts. This vulnerability aligns with ATT&CK technique T1531 for Establishing Persistence and T1566 for Phishing, as it can be leveraged to create persistent access points and social engineering campaigns. The weakness represents a critical security gap in input validation and output encoding practices, demonstrating inadequate security controls in the application's data handling processes.
Mitigation strategies should focus on implementing comprehensive input validation and output encoding mechanisms throughout the application's data flow. The system must employ strict sanitization of all user inputs, particularly in fields where HTML content is not expected, using libraries such as HTML Purifier or similar validation frameworks. Implementing Content Security Policy headers with strict directives can prevent execution of unauthorized scripts even if the vulnerability is exploited. Additionally, the application should utilize parameterized queries and proper HTML encoding when displaying user-supplied data. Security patches should be applied immediately to update the application to a version that addresses the XSS vulnerability, while implementing web application firewalls to detect and block malicious input patterns. Regular security testing including dynamic application security testing and manual penetration testing should be conducted to identify similar vulnerabilities in other input fields. The organization should also establish secure coding practices and conduct regular security training for developers to prevent similar issues in future application development cycles.