| शीर्षक | SourceCodester Queue Management System Unknown (code version as of 2025-10-22) Cross-Site Scripting (XSS) - CWE-79 |
|---|
| विवरण | The Queue Management System allows unauthenticated attackers to inject arbitrary JavaScript code via the "name" parameter in the /api/add_customer.php endpoint. The input is stored in the database without sanitization and later rendered unsafely in the administrative dashboard (index.php) using innerHTML, leading to stored XSS. An attacker can exploit this by sending a POST request with a malicious payload (e.g., <img src=x onerror=alert('XSS')>) in the name field. When an administrator views the queue list, the script executes in their browser, potentially allowing session hijacking, data theft, or unauthorized actions.Please refer to the "Stored Cross-Site Scripting (XSS) in Queue Management System.pdf" file on the GitHub address. The password for unzipping the report is: ABC123.. |
|---|
| स्रोत | ⚠️ https://github.com/Jack-MRJ/Queue-Management-System-Vulnerability-Report |
|---|
| उपयोगकर्ता | GeekerA (UID 97423) |
|---|
| सबमिशन | 15/07/2026 08:41 AM (2 महीनों पहले) |
|---|
| संयम | 29/08/2026 08:50 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397070 [SourceCodester Queue Management System 1.0 /api/add_customer.php नाम क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|