| शीर्षक | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Cross Site Scripting (CWE-79) |
|---|
| विवरण | A stored cross-site scripting (XSS) vulnerability exists in the SourceCodester Smart
Attendance System with QR Code Scanner (PHP/MySQL). The public self-registration
endpoint student_signup.php stores the full_name field without sanitization. The
unauthenticated check-in API api/attendance_handler.php returns this value verbatim
in the JSON 'student' field without output encoding. The admin QR-scanning kiosk page
scan_attendance.php renders the value into the DOM via a jQuery template literal
(prepend()) with no escaping, so an attacker who registers a student with an
HTML/JavaScript payload in full_name triggers arbitrary JavaScript execution in the
authenticated administrator's browser session whenever that student code is scanned.
Impact: session hijacking, full administrative control, attendance data tampering and
defacement. Note: the full_name column is VARCHAR(100); payloads longer than 100
characters are truncated.
The report can be found at the CVE_Stored_XSS_Report_v1.pdf file in the GitHub address.
The password for unzipping is abc123.. |
|---|
| स्रोत | ⚠️ https://github.com/Jack-MRJ/Smart-Attendance-System-with-QR-Code-Scanner |
|---|
| उपयोगकर्ता | jinxing (UID 99752) |
|---|
| सबमिशन | 30/08/2026 12:37 PM (24 दिन पहले) |
|---|
| संयम | 22/09/2026 07:26 PM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408556 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 Self-Registration student_signup.php prepend full_name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|