| タイトル | SourceCodester Online Book Store System 1.0 Stored Cross Site Scripting (Stored XSS) |
|---|
| 説明 | A Stored Cross-Site Scripting (Stored XSS) vulnerability was identified in the System Settings module of the Online Book Store System using PHP/MySQLi. The application fails to properly validate and sanitize user-supplied input before storing it in the database. As a result, an authenticated attacker with access to the affected functionality can inject malicious JavaScript payloads that are permanently stored by the application.
Whenever another user or administrator visits the affected page, the injected script is automatically executed in the victim's browser within the application's trusted context. Successful exploitation may allow an attacker to steal session cookies, hijack authenticated sessions, perform unauthorized actions on behalf of the victim, modify application content, or redirect users to malicious websites. If the payload is viewed by an administrator, the vulnerability could lead to full administrative account compromise.
The issue is caused by insufficient input validation and improper output encoding within the System Settings module. Implementing strict server-side input validation, context-aware output encoding, and an appropriate Content Security Policy (CSP) would significantly reduce the risk of exploitation.
Severity: High (may be Critical if exploitable by an administrator and leads to complete application compromise). |
|---|
| ソース | ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-system-settings-module-fa4f99ed1544 |
|---|
| ユーザー | Hemant Raj Bhati (UID 95613) |
|---|
| 送信 | 2026年06月26日 14:09 (2 月 ago) |
|---|
| モデレーション | 2026年08月14日 21:28 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 390097 [SourceCodester Online Book Store System 1.0 System Settings index.php?page=site_settings クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|