| Titolo | sourceCodester Online Leave Management System V1.0 Cross Site Scripting |
|---|
| Descrizione | Validation Method
The finding was validated in a local authorized test environment through source code review, HTTP/browser verification, DOM or rendered HTML inspection, and popup screenshot evidence. The payload, affected input, trigger location, and rendered execution context are included below so the issue can be reviewed and reproduced.
Vulnerable Location
Affected File: app/classes/Master.php:300; app/classes/Master.php:302; app/classes/Master.php:305; app/admin/employees/manage_employee.php:94; app/admin/employees/manage_employee.php:100
Affected Component: employee avatar upload extension rendered in hidden field and image src
Vulnerable Parameter / Field: employee avatar filename
Affected Endpoint: POST /classes/Master.php?f=save_employee; render /admin/employees/manage_employee.php?id=12
HTTP Method: POST
Render / Trigger Location: /admin/employees/manage_employee.php?id=12
Authentication Requirement: authenticated admin employee create/update; admin employee edit view triggers
Vulnerability Overview
The Online Leave Management System application does not properly encode or sanitize user-controlled input submitted through employee avatar filename. The value is later rendered in a browser context within /admin/employees/manage_employee.php?id=12, which allows JavaScript execution when the affected page is opened. This results in a filename cross-site scripting vulnerability. |
|---|
| Fonte | ⚠️ https://github.com/cm126261/CVE/issues/1 |
|---|
| Utente | Smartiesxum (UID 102012) |
|---|
| Sottomissione | 15/10/2026 13:44 (24 giorni fa) |
|---|
| Moderazione | 08/11/2026 17:40 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 432916 [SourceCodester Online Leave Management System 1.0 Employee Avatar Upload Extension app/classes/Master.php employee avatar filename cross site scripting] |
|---|
| Punti | 20 |
|---|