| タイトル | sourceCodester Online Leave Management System V1.0 Cross Site Scripting |
|---|
| 説明 | Validation Method
The finding was validated in a local authorized test environment through source code review, HTTP/browser verification, DOM or rendered HTML inspection, and popup screenshot evidence. The payload, affected input, trigger location, and rendered execution context are included below so the issue can be reviewed and reproduced.
Vulnerable Location
Affected File: app/classes/Master.php:300; app/classes/Master.php:302; app/classes/Master.php:305; app/admin/employees/manage_employee.php:94; app/admin/employees/manage_employee.php:100
Affected Component: employee avatar upload extension rendered in hidden field and image src
Vulnerable Parameter / Field: employee avatar filename
Affected Endpoint: POST /classes/Master.php?f=save_employee; render /admin/employees/manage_employee.php?id=12
HTTP Method: POST
Render / Trigger Location: /admin/employees/manage_employee.php?id=12
Authentication Requirement: authenticated admin employee create/update; admin employee edit view triggers
Vulnerability Overview
The Online Leave Management System application does not properly encode or sanitize user-controlled input submitted through employee avatar filename. The value is later rendered in a browser context within /admin/employees/manage_employee.php?id=12, which allows JavaScript execution when the affected page is opened. This results in a filename cross-site scripting vulnerability. |
|---|
| ソース | ⚠️ https://github.com/cm126261/CVE/issues/1 |
|---|
| ユーザー | Smartiesxum (UID 102012) |
|---|
| 送信 | 2026年10月15日 13:44 (24 日 ago) |
|---|
| モデレーション | 2026年11月08日 17:40 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 432916 [SourceCodester Online Leave Management System 1.0 Employee Avatar Upload Extension app/classes/Master.php employee avatar filename クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|