| タイトル | PHPGurukul Human Metapneumovirus (HMPV) – Testing Management System 1.0 Cross Site Scripting |
|---|
| 説明 | There is a Cross - Site Scripting (XSS) vulnerability on the `registered-user-testing.php` page. Although the front - end restricts the `regmobilenumber` input to numbers only, the back - end fails to validate, filter, or encode the output of this parameter.
Attackers can construct a malicious URL by setting the `regmobilenumber` parameter to `<script>alert("xss")</script>` and adding `search=Search` to simulate a search, bypassing the front - end restriction. When users visit the URL with these malicious parameters, the page will execute the script, triggering an "xss" alert box.
This high - risk vulnerability allows attackers to create sophisticated malicious scripts to steal users' session credentials and login information, redirect the page to malicious websites, or perform other malicious actions, severely threatening user privacy and system security. |
|---|
| ソース | ⚠️ https://github.com/sorcha-l/cve/blob/main/Human%20Metapneumovirus%20(HMPV)%20%E2%80%93%20Testing%20Management%20System%20%20XSS%20in%20registered-user-testing.php.md |
|---|
| ユーザー | lxk_ (UID 81990) |
|---|
| 送信 | 2025年03月06日 10:56 (2 年 ago) |
|---|
| モデレーション | 2025年03月16日 14:18 (10 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 299870 [PHPGurukul Human Metapneumovirus Testing Management System 1.0 Registered Mobile Number Search registered-user-testing.php regmobilenumber クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|