| शीर्षक | CodeAstro Human Resource Management System in PHP CodeIgniter v1.0 Cross Site Scripting |
|---|
| विवरण | A stored cross-site scripting (XSS) vulnerability has been identified in the Project Management functionality of CodeAstro Human Resource Management System in PHP CodeIgniter ( https://codeastro.com/human-resource-management-system-in-php-codeigniter-with-source-code/ ). The issue exists because user-controlled input submitted through the (protitle) parameter is not properly sanitized before being stored and rendered within project-related pages.
An authenticated attacker can inject arbitrary JavaScript payloads into the Project Title field while creating a new project. The malicious payload is executed immediately after submission and continues to execute persistently whenever users visit the Projects Management page or open the affected project.
Since project titles are visible to every other users across the organization, successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of authenticated users. This may lead to session hijacking, unauthorized actions, phishing attacks, content manipulation, or theft of sensitive information accessible within the application context.
|
|---|
| स्रोत | ⚠️ https://github.com/ashikmd0507/CVE/tree/main/Stored-XSS-via-Project-Title |
|---|
| उपयोगकर्ता | ashikmd7 (UID 98284) |
|---|
| सबमिशन | 26/05/2026 01:54 PM (4 महीनों पहले) |
|---|
| संयम | 12/06/2026 05:21 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 370615 [CodeAstro Human Resource Management System 1.0 Projects Management Page /Projects/Add_Projects protitle क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|