| शीर्षक | itsourcecode Online Petshop Management System 1 Stored XSS in Admin Dashboard Triggered by Customer Orders |
|---|
| विवरण | The Petshop Online Website is vulnerable to Stored Cross-Site Scripting (XSS) via the order submission form. If a visitor submits an order with a malicious payload in the name or address fields, the input is stored in the database (tblorders) and later displayed directly on the admin dashboard without sanitization or escaping. As a result, the payload executes immediately in the admin’s browser when they view the new order. This allows an attacker to execute arbitrary JavaScript in the context of the admin user, potentially stealing cookies, performing actions on behalf of the admin, or manipulating dashboard content. The vulnerability exists because user input is stored and reflected without validation or output encoding. |
|---|
| स्रोत | ⚠️ https://github.com/drew-byte/Online-Pet-Shop-Management-System_AdminDashboard_Stored-XSS-PoC/blob/main/README.md |
|---|
| उपयोगकर्ता | drewbyte (UID 89075) |
|---|
| सबमिशन | 09/09/2025 09:39 AM (1 वर्ष पहले) |
|---|
| संयम | 17/09/2025 02:12 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 324661 [itsourcecode Online Petshop Management System 1.0 Admin Dashboard availableframe.php name/address क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|