| शीर्षक | PHPGurukul Company Visitor Management System PHP V2.0 Stored Cross-Site Scripting (CWE-79) |
|---|
| विवरण | During the security review of "Company Visitor Management System PHP V2.0", I discovered a stored Cross-Site Scripting vulnerability in the "/manage-newvisitors.php" file. This vulnerability stems from insufficient input validation and output encoding of the 'fullname' parameter. The data flow is as follows: (1) '/visitors-form.php' accepts the 'fullname' parameter from a POST request and inserts it directly into the database via an unsanitized SQL INSERT query; (2) '/manage-newvisitors.php' retrieves the stored data with a SQL SELECT query and echoes it into an HTML table using raw PHP echo statements without htmlspecialchars() or any other output encoding. An attacker who can submit a visitor record (authenticated admin, or unauthenticated via the SQL injection login bypass in /index.php) can store a JavaScript payload in the FullName field. The script then executes in the browser of any administrator who views the visitor list, search results, visitor details, or date range reports. Immediate remedial measures are needed to ensure system security and protect data integrity. |
|---|
| स्रोत | ⚠️ https://github.com/mzxqqwq/CVE/issues/3 |
|---|
| उपयोगकर्ता | mzxqqwq (UID 99169) |
|---|
| सबमिशन | 21/06/2026 01:55 PM (2 महीनों पहले) |
|---|
| संयम | 07/08/2026 10:12 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386952 [PHPGurukul Company Visitor Management System 1.0 /manage-newvisitors.php fullname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|