| Título | GitHub robo-cafe-rms 1.0 Cross Site Scripting |
|---|
| Descripción | VULNERABILITY DESCRIPTION:
A Cross-Site Scripting (XSS) vulnerability was discovered in the Robo Cafe Restaurant Management System (robo-cafe-rms) version 1.0. The application fails to properly sanitize or neutralize user-supplied input before rendering it back onto the webpage. An attacker can exploit this weakness by injecting a malicious script into the vulnerable input fields (Name, Address, and City) located within the update-account.php script. This allows the execution of arbitrary JavaScript code in the context of an unsuspecting user's browser session whenever they view the affected account profile page.
PROOF OF CONCEPT (PoC) / REPRODUCTION STEPS:
1. Log into the Robo Cafe Restaurant Management System application.
2. Navigate to http://localhost:8000/frontend/login.php.
3. Create any account with any username password.
4. Then navigate to http://localhost:8000/frontend/myaccount.php and in the edit profile feature the Name, Address, or City input field, insert a standard XSS script payload: <script>alert(document.cookie)</script>
5. Click submit to save the changes.
6. The payload will be successfully stored in the application. Whenever an administrative user or the victim views this specific profile record, the JavaScript payload executes automatically in their browser.
|
|---|
| Fuente | ⚠️ https://github.com/mwasikz/robo-cafe-rms |
|---|
| Usuario | dexter-morgan (UID 100687) |
|---|
| Sumisión | 2026-08-19 23:54 (hace 1 mes) |
|---|
| Moderación | 2026-09-28 22:10 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 411166 [mwasikz robo-cafe-rms hasta 228c44a02823f04e85db32b7137809a2856148fc Edit Profile Feature update-account.php Name/Address/City secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|