| タイトル | Projectwolds Online Attendance System in PHP MYSQL 1.0 Cross Site Scripting |
|---|
| 説明 | vulnerability was found in Projectworlds Online Attendance System in PHP 1.0. It has been classified as problematic. Affected is an unknown function of the file profile.php of the component Profile Handler. The manipulation of the argument email leads to cross site scripting.
The email input field in the profile-update functionality (php/update_profile.php) is validated using a weak regular expression that only rejects whitespace characters, failing to filter HTML/JavaScript metacharacters such as <, >, and ". As a result, an attacker-controlled value can be persisted to the database. When the profile page (profile.php) subsequently renders the stored email value into an HTML value attribute without output encoding (no htmlspecialchars() applied), the crafted payload breaks out of the attribute context and executes as live script in the browser of any user viewing the page.
This is classified as a stored (persistent) XSS, since the payload is saved server-side and re-executes on every subsequent page load until overwritten.
It was additionally observed that the application's session cookie (PHPSESSID) is issued without the HttpOnly flag, meaning the same injection point can be leveraged to read and exfiltrate the session cookie via document.cookie, escalating impact from script execution to full session hijacking.
Attack Requirements: The attacker needs valid low-privileged credentials to reach the profile-update endpoint. Exploitation was confirmed by authenticating, submitting the crafted payload as the email value, and observing execution of injected <script> content when the profile page was reloaded.
Proof of Concept payload: x"><script>alert(document.cookie)</script>@a.com
Impact: Confidentiality: High (session cookie theft, account takeover). Integrity: Low (attacker can act as victim post-hijack). Availability: None.
Recommended Fix:
Replace the weak email regex with filter_var($email, FILTER_VALIDATE_EMAIL) or an equivalent strict validator that rejects HTML-significant characters.
Apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to all user-controlled output rendered into HTML.
Set the HttpOnly flag on the PHPSESSID cookie via session.cookie_httponly=1 or session_set_cookie_params()
Discoverer: Shailendra Mourya (CyberShailendra) |
|---|
| ソース | ⚠️ https://github.com/CyberShailendra1/Online-Attendance-System-Projectworlds |
|---|
| ユーザー | CyberShailendra (UID 99999) |
|---|
| 送信 | 2026年07月21日 06:27 (2 月 ago) |
|---|
| モデレーション | 2026年09月06日 06:05 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 399379 [Projectwolds Online Attendance System 1.0 profile.php email クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|