| शीर्षक | Project Worlds Visitor Management System unknown reflected Cross-Site Scripting (XSS) at dataset.php |
|---|
| विवरण | The Visitor Management System developed by Project Worlds is found to have a security vulnerability that exposes it to reflected Cross-Site Scripting (XSS) attacks. This vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to unauthorized access, data theft, or other security breaches.
### **Description:**
The application fails to properly validate and sanitize the user input received through the URL parameter **`name`**. As a result, an attacker can inject malicious scripts into the page, leading to the execution of arbitrary JavaScript code in the context of the victim's browser.
### **Proof of Concept:**
To demonstrate the exploit, an attacker can craft a URL with a malicious payload as follows:
1. Access the vulnerable page with the crafted URL:
https://localhost/Visitor%20Management%20System%20in%20PHP/datetest.php?name="><script>alert('torada')</script>
2. Upon loading the page, the injected script triggers an alert with the message 'torada', indicating successful exploitation.
project link
https://projectworlds.in/visitor-management-system-in-php-and-mysql/ |
|---|
| स्रोत | ⚠️ https://torada.notion.site/XSS-at-datatest-php-660aabd1437d4df7a492d19a461a1f3c?pvs=4 |
|---|
| उपयोगकर्ता | torada (UID 61170) |
|---|
| सबमिशन | 14/01/2024 08:12 PM (3 साल पहले) |
|---|
| संयम | 17/01/2024 03:02 PM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 251376 [Project Worlds Visitor Management System 1.0 URL dataset.php name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|