| Titre | code-projects Task Management System In PHP With Source Code 1.0 Cross Site Scripting |
|---|
| Description | A remote unauthenticated stored cross-site scripting vulnerability exists in Code-Projects Task Management System In PHP With Source Code 1.0.
The affected write endpoint is /user/CommentSave.php and the affected argument is comment. The endpoint does not require an authenticated session. It accepts the attacker-controlled comment, task_id, mineId, recId, myName, and myImage parameters and stores them in the comments table.
The stored comment_text value is later rendered by /user/comment_count_user.php and /admin/comment_count.php as raw HTML without contextual output encoding.
An unauthenticated attacker can submit the following payload:
<img src=x onerror=alert(1337)>
The tested HTTP request did not contain a Cookie or Authorization header:
POST /PROJECT_NEW/user/CommentSave.php HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Connection: close
comment=%3Cimg%20src%3Dx%20onerror%3Dalert%281337%29%3E&task_id=2&mineId=7777&recId=10&myName=XSS-Test&myImage=%2Fimages%2Ffake.png
The application returned HTTP 200 and confirmed the insertion:
<span class='status-available'>10</span>
An unauthenticated browser then visited:
http://TARGET/PROJECT_NEW/user/comment_count_user.php?task_id=2
The browser executed the stored event handler and displayed an alert containing 1337. The raw HTTP response contained the original executable HTML:
<td align="center"><img src=x onerror=alert(1337)></td>
This allows an unauthenticated attacker to persist JavaScript which executes with the same-origin privileges of a user or administrator viewing the affected comments. The script can read application information available to the victim and issue authenticated state-changing requests through the victim's browser.
The issue is classified as CWE-79.
CVSS 3.1: 9.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected package:
TASK_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE.zip
SHA-256:
8a4bf7950b97ea99e05ff9655185678fc1b13b5d79099f3aa7060dd438ac1d54
Vendor contact:
Code-Projects was contacted at [email protected] from [email protected] on June 23, 2026 at 16:11:39 BST. The response is pending. |
|---|
| La source | ⚠️ https://github.com/littleRain1355/PHPissue/issues/5 |
|---|
| Utilisateur | rainless100792 (UID 84115) |
|---|
| Soumission | 23/06/2026 17:14 (il y a 2 mois) |
|---|
| Modérer | 09/08/2026 17:05 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 387271 [code-projects Task Management System 1.0 /user/CommentSave.php comment/task_id/mineId/recId/myName/myImage cross site scripting] |
|---|
| Points | 20 |
|---|