| शीर्षक | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| विवरण | A reflected cross-site scripting (XSS) vulnerability exists in the /drug_recommender/Admin/add_user endpoint of Sourcecodester's Drug Recommendation System. The txtname, txtemail, and txtpassword POST parameters are reflected into HTML input attributes without proper output encoding, allowing an authenticated attacker to inject arbitrary JavaScript into the administrator's browser. The injected payload is also persisted in the database and subsequently executed when the affected user record is viewed, resulting in stored XSS in the user-record page. The application's PHP session cookie is accessible through JavaScript due to the absence of the HttpOnly flag, potentially allowing session information to be exposed.
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Anubhav Verma
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher - 3
Name: Parth Desai
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/ |
|---|
| स्रोत | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_user/Readme.md |
|---|
| उपयोगकर्ता | anubhav106 (UID 98769) |
|---|
| सबमिशन | 25/08/2026 02:18 PM (26 दिन पहले) |
|---|
| संयम | 19/09/2026 07:48 PM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407961 [SourceCodester Drug Recommendation System 1.0 User Management add_user txtname/txtemail/txtpassword क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|