| शीर्षक | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| विवरण | A reflected cross-site scripting (XSS) vulnerability exists in the /drug_recommender/Admin/change_password endpoint of Sourcecodester's Drug Recommendation System. The txtoldpassword and txtnewpassword POST parameters are reflected into HTML input attributes without proper output encoding, allowing an authenticated attacker to inject arbitrary JavaScript into the administrator's browser by breaking out of the affected attribute context. The vulnerability can be triggered by submitting a crafted password value, causing the injected script to execute in the administrator's session context. The application's PHP session cookie is also accessible through JavaScript because the session cookie lacks the HttpOnly flag, potentially allowing the PHPSESSID value to be exposed and enabling further session compromise.
vendor: https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html
CVSS: 6.1 (Medium)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Anubhav Verma
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher - 3
Name: Parth Desai
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/
|
|---|
| स्रोत | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/change_password/Readme.md |
|---|
| उपयोगकर्ता | anubhav106 (UID 98769) |
|---|
| सबमिशन | 25/08/2026 02:42 PM (26 दिन पहले) |
|---|
| संयम | 19/09/2026 07:48 PM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407962 [SourceCodester Drug Recommendation System 1.0 Password Change change_password txtoldpassword/txtnewpassword क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|