| Titel | SourceCodester Accounts Manager App Using PHP and MySQL 1.0 Stored Cross Site Scripting (XSS) |
|---|
| Beschreibung | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Accounts Manager App Using PHP and MySQL version 1.0.
The vulnerability occurs in the Add Account functionality.
Vulnerable Input Endpoint:
POST /account-manager-app/endpoint/add-account.php
Vulnerable Output Location:
GET /account-manager-app/index.php
User input supplied in the following fields is not properly sanitized before being stored in the database and rendered in the main dashboard:
* Account Name
* Username
* URL
An attacker can inject malicious JavaScript payload which will be stored permanently and executed whenever the data is viewed in the application.
Proof of Concept (PoC):
1. Open the application:
http://localhost/account-manager-app/
2. Click on **Add Account**
3. Insert the following payload in the Account Name or URL field:
<script>alert(1)</script>
OR
" autofocus onfocus=alert(1) x="
4. Click **Save Account**
5. After saving, return to the main dashboard.
6. The JavaScript payload executes automatically when the stored data is rendered, confirming a Stored Cross-Site Scripting vulnerability.
Impact:
* Execution of arbitrary JavaScript in the victim's browser
* Session hijacking
* Credential theft
* Account takeover
* Defacement or malicious redirection
The issue occurs due to missing input validation and output encoding.
Recommended Fix:
* Implement proper input validation and sanitization
* Apply output encoding (e.g., htmlspecialchars in PHP)
* Use a Content Security Policy (CSP)
|
|---|
| Quelle | ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-accounts-manager-app-using-php-and-mysql-sourcecodester-ab557de210bb |
|---|
| Benutzer | Hemant Raj Bhati (UID 95613) |
|---|
| Einreichung | 20.02.2026 19:59 (vor 8 Monaten) |
|---|
| Moderieren | 02.03.2026 20:45 (10 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 274368 [SourceCodester Accounts Manager App 1.0 add-account.php account_name Cross Site Scripting] |
|---|
| Punkte | 0 |
|---|