| शीर्षक | SourceCodester Online Railway Reservation System 1.0 Cross Site Scripting |
|---|
| विवरण | A Stored Cross site Scripting Vulnerability was discoveed in Sourcecoderster's Online Railway Reservation System
Vulnerable product:https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html
The page contact_us.php has functionality to send inquiries of customers to the admin, but the insecure design of /admin/inquiries/index.php makes it vulnerable to send a malicious JavaScript code. Once the admin visits the inquiries page, the JavaScript code gets executed and can be used to steal the admin's cookies.
The index.php file is vulnerable to XSS attacks. XSS: The <?= ucwords($row['fullname']) ?>, <?= ($row['email']) ?>, and <?= ($row['message']) ?> code is vulnerable to XSS attacks because it directly outputs user-input data without proper sanitization or encoding.
Check more details in Advisory |
|---|
| स्रोत | ⚠️ https://github.com/gurudattch/CVEs/blob/main/Sourcecoderster-Online-Railway-Reservation-System-stored-xss.md |
|---|
| उपयोगकर्ता | guru (UID 74056) |
|---|
| सबमिशन | 23/09/2024 01:45 PM (2 साल पहले) |
|---|
| संयम | 27/09/2024 06:47 PM (4 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 278794 [SourceCodester Online Railway Reservation System 1.0 Message Us Form contact_us.php fullname/email/message क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|