제출 #764397: SourceCodester Accounts Manager App Using PHP and MySQL 1.0 Stored Cross Site Scripting (XSS)

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Accounts Manager App Using PHP and MySQL version 1.0.

The vulnerability occurs in the Add Account functionality.

Vulnerable Input Endpoint:
POST /account-manager-app/endpoint/add-account.php

Vulnerable Output Location:
GET /account-manager-app/index.php

User input supplied in the following fields is not properly sanitized before being stored in the database and rendered in the main dashboard:

* Account Name
* Username
* URL

An attacker can inject malicious JavaScript payload which will be stored permanently and executed whenever the data is viewed in the application.

Proof of Concept (PoC):

1. Open the application:
http://localhost/account-manager-app/

2. Click on **Add Account**

3. Insert the following payload in the Account Name or URL field:

<script>alert(1)</script>

OR

" autofocus onfocus=alert(1) x="

4. Click **Save Account**

5. After saving, return to the main dashboard.

6. The JavaScript payload executes automatically when the stored data is rendered, confirming a Stored Cross-Site Scripting vulnerability.

Impact:

* Execution of arbitrary JavaScript in the victim's browser
* Session hijacking
* Credential theft
* Account takeover
* Defacement or malicious redirection

The issue occurs due to missing input validation and output encoding.

Recommended Fix:

* Implement proper input validation and sanitization
* Apply output encoding (e.g., htmlspecialchars in PHP)
* Use a Content Security Policy (CSP)

• 원천: ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-accounts-manager-app-using-php-and-mysql-sourcecodester-ab557de210bb
• 사용자: Hemant Raj Bhati (UID 95613)
• 제출: 2026. 02. 20. PM 07:59 (8 개월 ago)
• 모더레이션: 2026. 03. 02. PM 08:45 (10 days later)
• 상태: 중복
• VulDB 항목: 274368 [SourceCodester Accounts Manager App 1.0 add-account.php account_name 크로스 사이트 스크립팅]
• 포인트들: 0