| शीर्षक | SourceCodester Online Book Store System 1.0 Stored Cross Site Scripting (Stored XSS) |
|---|
| विवरण | A Stored Cross-Site Scripting (Stored XSS) vulnerability was identified in the System Settings module of the Online Book Store System using PHP/MySQLi. The application fails to properly validate and sanitize user-supplied input before storing it in the database. As a result, an authenticated attacker with access to the affected functionality can inject malicious JavaScript payloads that are permanently stored by the application.
Whenever another user or administrator visits the affected page, the injected script is automatically executed in the victim's browser within the application's trusted context. Successful exploitation may allow an attacker to steal session cookies, hijack authenticated sessions, perform unauthorized actions on behalf of the victim, modify application content, or redirect users to malicious websites. If the payload is viewed by an administrator, the vulnerability could lead to full administrative account compromise.
The issue is caused by insufficient input validation and improper output encoding within the System Settings module. Implementing strict server-side input validation, context-aware output encoding, and an appropriate Content Security Policy (CSP) would significantly reduce the risk of exploitation.
Severity: High (may be Critical if exploitable by an administrator and leads to complete application compromise). |
|---|
| स्रोत | ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-system-settings-module-fa4f99ed1544 |
|---|
| उपयोगकर्ता | Hemant Raj Bhati (UID 95613) |
|---|
| सबमिशन | 26/06/2026 02:09 PM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 09:28 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390097 [SourceCodester Online Book Store System 1.0 System Settings index.php?page=site_settings क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|