| शीर्षक | PHPGurukul COVID-19 Testing Management System 2021 version Cross-Site Scripting (XSS) |
|---|
| विवरण | The search-report-result.php endpoint of the COVID-19 Testing Management System is vulnerable to reflected Cross-Site Scripting (XSS). User-supplied input passed through the q parameter is improperly handled and reflected into the HTML response without appropriate sanitization. This enables an attacker to inject arbitrary JavaScript code into the victim’s browser.
When a user submits a search query, the application reflects the input directly into the page, making it susceptible to XSS. An attacker can craft a malicious URL and trick a victim into clicking it, resulting in the execution of JavaScript, such as cookie theft or session hijacking.
Affected Endpoint:
/search-report-result.php using with this payload<img src=x onerror=alert(document.cookie)>
|
|---|
| स्रोत | ⚠️ http://localhost/covid-tms/search-report-result.php |
|---|
| उपयोगकर्ता | Anzil (UID 86393) |
|---|
| सबमिशन | 10/06/2025 09:01 AM (1 वर्ष पहले) |
|---|
| संयम | 19/06/2025 09:22 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 313289 [PHPGurukul COVID19 Testing Management System 2021 search-report-result.php q क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|