| 제목 | PHPGurukul Cyber Cafe Management System Using PHP & MySQL 1.0 Cross Site Scripting |
|---|
| 설명 | A fundamental web security principle is that all untrusted input must be validated and properly encoded before being included in HTML responses to prevent client-side code execution. However, during the security review it was found that search.php directly echoes the searchdata POST parameter into the page (<h4 align="center">Result against "<?php echo $sdata;?>" keyword </h4>) without any output encoding or sanitization, allowing an attacker to inject HTML/JavaScript that will execute in the context of a victim’s browser. Successful exploitation of this reflected XSS can lead to session cookie theft (if cookies lack HttpOnly), forced actions on behalf of authenticated users, theft of sensitive information visible in the browser, and other client-side attacks that may escalate to account takeover or further lateral misuse. This unchecked reflection substantially increases the application’s attack surface and risk to user confidentiality and trust. |
|---|
| 원천 | ⚠️ https://github.com/r4vindra/Cyber-Cafe-Management-System/blob/main/README.md |
|---|
| 사용자 | r4vindra (UID 91109) |
|---|
| 제출 | 2025. 09. 29. PM 05:12 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 10. 13. PM 06:52 (14 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 327317 [PHPGurukul Cyber Cafe Management System 1.0 POST Parameter /search.php searchdata 크로스 사이트 스크립팅] |
|---|
| 이유 | Vendor source not identifiable. Please reply with website of the responsible vendor. |
|---|
| 포인트들 | 0 |
|---|