| शीर्षक | Codeastro Stock Management System 1 Cross-Site Scripting |
|---|
| विवरण | Project Name: Stock Management System
Vendor: codeastro.com
Project Link: [Stock Management System]( https://codeastro.com/stock-management-system-in-php-with-source-code/)
Vulnerability Type: Cross-site Scripting
Affected Parameter: http://localhost/StockManagementSystem/index.php
Severity: Medium
Description:
The Stock Management System is vulnerable to cross-site scripting attack in index.php when an attacker enters a script payload in the “Category Name”, “Category Description” of the ADD CATEGORY button at Categories module. When the user click on the categories module the alert prompt will be popping up.
Exploited Parameter:
- Category Name and Category Description field of the ADD CATEGORY button in the Categories module.
Payloads Used:
<script>alert(“category”)</script>
<script>alert(“categoryd”)</script>
Recommendations:
1. *Input Validation:* Implement strict input validation to prevent XSS injection.
2. *Update System:* Keep the Stock Management System, PHP, and server components up-to-date with the latest security patches.
3. *Security Audits:* Regularly audit system security and consider professional assessments to identify and fix vulnerabilities.
4. *Education:*The application developers on secure coding practices, emphasizing input validation and secure database handling.
Timeline:
- Discovery Date: [23/01/2024]
|
|---|
| स्रोत | ⚠️ https://drive.google.com/drive/folders/17JTwjuT09q7he_oXkMtZS5jyyXw8ZIgg?usp=sharing |
|---|
| उपयोगकर्ता | Mohammed Aashique (UID 62025) |
|---|
| सबमिशन | 23/01/2024 08:31 AM (3 साल पहले) |
|---|
| संयम | 26/01/2024 06:11 PM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 252203 [CodeAstro Stock Management System 1.0 Add Category /index.php Category Name/Category Description क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|