| शीर्षक | hemant6488 CodeIgniter-StudentManagementSystem 1.0 Stored Cross-Site Scripting |
|---|
| विवरण | The `addStudent` method in the `Students` controller does not perform any input filtering or sanitisation before storing user-supplied data in the database. Subsequently, the `view_students.php` view renders the student’s name directly without HTML entity encoding.
This allows an attacker to inject arbitrary JavaScript (e.g., via the `name` parameter) that is persisted in the database and executed whenever any user visits the student listing page. Because the endpoint is accessible without authentication (see the Broken Access Control vulnerability), the attack can be carried out by an anonymous remote user. |
|---|
| स्रोत | ⚠️ https://github.com/hemant6488/CodeIgniter-StudentManagementSystem/issues/6 |
|---|
| उपयोगकर्ता | BingZhe (UID 97643) |
|---|
| सबमिशन | 27/04/2026 05:53 PM (5 महीनों पहले) |
|---|
| संयम | 25/05/2026 09:08 PM (28 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 365538 [hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|