| Titre | SourceCodester Accounts Manager App Using PHP and MySQL 1.0 Stored Cross Site Scripting (XSS) |
|---|
| Description | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Accounts Manager App Using PHP and MySQL version 1.0.
The vulnerability occurs in the Add Account functionality.
Vulnerable Input Endpoint:
POST /account-manager-app/endpoint/add-account.php
Vulnerable Output Location:
GET /account-manager-app/index.php
User input supplied in the following fields is not properly sanitized before being stored in the database and rendered in the main dashboard:
* Account Name
* Username
* URL
An attacker can inject malicious JavaScript payload which will be stored permanently and executed whenever the data is viewed in the application.
Proof of Concept (PoC):
1. Open the application:
http://localhost/account-manager-app/
2. Click on **Add Account**
3. Insert the following payload in the Account Name or URL field:
<script>alert(1)</script>
OR
" autofocus onfocus=alert(1) x="
4. Click **Save Account**
5. After saving, return to the main dashboard.
6. The JavaScript payload executes automatically when the stored data is rendered, confirming a Stored Cross-Site Scripting vulnerability.
Impact:
* Execution of arbitrary JavaScript in the victim's browser
* Session hijacking
* Credential theft
* Account takeover
* Defacement or malicious redirection
The issue occurs due to missing input validation and output encoding.
Recommended Fix:
* Implement proper input validation and sanitization
* Apply output encoding (e.g., htmlspecialchars in PHP)
* Use a Content Security Policy (CSP)
|
|---|
| La source | ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-accounts-manager-app-using-php-and-mysql-sourcecodester-ab557de210bb |
|---|
| Utilisateur | Hemant Raj Bhati (UID 95613) |
|---|
| Soumission | 20/02/2026 19:59 (il y a 7 mois) |
|---|
| Modérer | 02/03/2026 20:45 (10 days later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 274368 [SourceCodester Accounts Manager App 1.0 add-account.php account_name cross site scripting] |
|---|
| Points | 0 |
|---|