| शीर्षक | PHPGurukul Staff Leave Management System v1.0 Cross Site Scripting |
|---|
| विवरण | A critical stored cross-site scripting (XSS) vulnerability exists in the Staff Leave Management System due to unrestricted file upload functionality in the profile picture feature. The application fails to validate uploaded file types and content, allowing authenticated administrators to upload malicious SVG files containing embedded JavaScript code.
The vulnerability exists in two locations:
Admin profile update functionality (http://127.0.0.1:8000/Profile)
Staff creation functionality (http://127.0.0.1:8000/Admin/Staff/Add)
The application accepts SVG files without content inspection or sanitisation. When these files are rendered in the browser (either by viewing user profiles or opening images in new tabs), the embedded JavaScript executes in the security context of any user viewing the content, including other administrators. |
|---|
| स्रोत | ⚠️ https://github.com/rsecroot/Staff-Leave-Management-System/blob/main/Cross%20Site%20Scripting.md |
|---|
| उपयोगकर्ता | hackerfactory (UID 85869) |
|---|
| सबमिशन | 06/01/2026 10:29 PM (9 महीनों पहले) |
|---|
| संयम | 08/01/2026 04:13 PM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 340127 [PHPGurukul Staff Leave Management System 1.0 SVG File adminviews.py ADD_STAFF/UPDATE_STAFF profile_pic क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|