| 제목 | SourceCodester My Food Recipe 1.0 Stored Cross Site Scripting |
|---|
| 설명 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the My Food Recipe application developed by SourceCodester. The vulnerability resides in the "Add Recipe" functionality, where user-supplied input is improperly sanitized before being stored and rendered, allowing arbitrary JavaScript to be executed in the context of other users' sessions.
Affected Field: recipe_name (input type: text)
Affected Endpoint: /endpoint/add-recipe.php (via #addRecipeModal modal form)
Input Vector: POST request via form submission
Impact: Stored JavaScript payload is triggered when the page loads or when the data is viewed.
Steps to Reproduce
Open the modal by clicking the Add Recipe button:
<button type="button" class="btn btn-add-food btn-secondary" data-toggle="modal" data-target="#addRecipeModal">Add Recipe</button>
In the Recipe Name field, insert the following payload:
<script>alert('PoC VulDB My Food Recipe')</script>
Fill the remaining fields with valid data (e.g., category, ingredients, procedure) and click Save changes.
Upon submitting the form, the payload is stored in the database.
Whenever the recipe data is rendered again (e.g., recipe listing or detail views), the JavaScript is executed, confirming a persistent (stored) XSS vulnerability.
|
|---|
| 원천 | ⚠️ https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README4.md |
|---|
| 사용자 | RaulPACXXX (UID 84502) |
|---|
| 제출 | 2025. 06. 14. PM 07:39 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 06. 19. PM 12:39 (5 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 313340 [SourceCodester My Food Recipe 1.0 Add Recipe Page /endpoint/add-recipe.php addRecipeModal 이름 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|