| शीर्षक | XSS in Simple Cashiering System can lead to Session Takeover |
|---|
| विवरण | The Simple Cashiering System (https://www.sourcecodester.com/php/14945/simple-cashiering-system-pos-php-and-sqlite-source-code-free-download.html) distributed by sourcecodester.com is vulnerable to XSS in the fullname field of any user account.
A malicious actor can abuse this by getting access to the application, modifying the fullname of their compromised user account and whenever the admin either visits the user tab in the admin dashboard or has a look at any of the orders taken by that account via the Sales tab the XSS is executed and the cookie can be extracted due to a missing HttpOnly flag. |
|---|
| उपयोगकर्ता | maikroservice (UID 35150) |
|---|
| सबमिशन | 11/11/2022 01:15 PM (4 साल पहले) |
|---|
| संयम | 11/11/2022 01:17 PM (2 minutes later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 213455 [Sourcecodester Simple Cashiering System User Account fullname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|