| タイトル | projectworlds Advanced Library Management System 1 Improper Neutralization of Alternate XSS Syntax |
|---|
| 説明 | A stored cross-site scripting (XSS) vulnerability was identified in Advanced Library Management System V1.0. The issue occurs in the /edit_admin.php?admin_id=1 endpoint, where the firstname POST parameter is stored in the database and later rendered in the application without proper escaping. An authenticated attacker can inject malicious JavaScript (e.g., <script>alert(/XSS/)</script>), which will execute whenever the affected page is viewed. Successful exploitation could lead to session hijacking, account takeover, CSRF, or distribution of malicious content to other users. The root cause is insufficient input validation and missing context-aware output encoding. Recommended fixes include applying htmlspecialchars() for output, enforcing strict input validation, implementing a Content Security Policy (CSP), and sanitizing existing stored values. |
|---|
| ソース | ⚠️ https://github.com/ChenGuangHuangHun/CVE/issues/2 |
|---|
| ユーザー | chenguang (UID 91178) |
|---|
| 送信 | 2025年10月01日 08:25 (1 年 ago) |
|---|
| モデレーション | 2025年10月07日 13:44 (6 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 327360 [projectworlds Advanced Library Management System 1.0 /edit_admin.php firstname クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|