| शीर्षक | code-projects Employee Leave Managing System In PHP With Source Code 1,0 Cross Site Scripting |
|---|
| विवरण | The Employee Leave Managing System in PHP v1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the employee profile update functionality.
The vulnerability exists in the endpoint responsible for updating employee information:
/EmpManageSys/editaction.php
The application accepts multiple user-controlled parameters during the employee update process, including name, email, pos, and password. The value supplied through the name parameter is processed and stored without sufficient input validation or sanitization.
After the update operation completes, the application stores the supplied value in the backend database. When the employee record is later viewed through the management interface or any page displaying employee information, the stored value is rendered directly into the HTML response without applying proper output encoding.
Because the application fails to encode user-controlled data before inserting it into the HTML document, an attacker can inject malicious HTML or JavaScript code into the name field. For example, the following payload can be submitted:
<details/open/ontoggle=alert(1)>
Once the payload has been stored, the malicious JavaScript is executed automatically whenever the affected employee profile or any page displaying the employee name is viewed by another authenticated user or administrator.
The vulnerability exists because the application relies on user input without performing adequate sanitization before storage and fails to apply contextual output encoding when displaying stored data. As a result, the browser interprets the injected content as executable HTML and JavaScript rather than plain text.
Successful exploitation allows an attacker to execute arbitrary JavaScript within the security context of the application. Depending on the privileges of the victim, this may enable session hijacking, theft of authentication cookies, execution of unauthorized actions on behalf of authenticated users, modification of application content, or delivery of phishing interfaces to other users.
Since the malicious payload is permanently stored by the application and is executed each time the affected data is viewed, the vulnerability is classified as a Stored (Persistent) Cross-Site Scripting (XSS) vulnerability. |
|---|
| स्रोत | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Employee%20Leave%20Managing%20System%20PHP%20name%20Parameter.md |
|---|
| उपयोगकर्ता | AhmadMarzook (UID 96211) |
|---|
| सबमिशन | 16/07/2026 07:34 PM (1 महीना पहले) |
|---|
| संयम | 30/08/2026 10:02 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397122 [code-projects Employee Leave Managing System 1.0 Employee Profile Update editaction.php नाम क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|