| 제목 | SourceCodester Online Book Store System 1.0 Stored Cross-Site Scripting (Authenticated) |
|---|
| 설명 | An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists in the User Management module of the Online Book Store Management System developed by SourceCodester.
The application fails to properly sanitize user-supplied input before storing and rendering it within administrative interfaces. An authenticated administrator can inject arbitrary JavaScript code into user-controllable fields. The malicious payload is stored in the backend database and executed whenever the affected record is viewed.
Successful exploitation allows execution of arbitrary JavaScript in the context of the application, potentially leading to session hijacking, unauthorized actions, user impersonation, interface manipulation, and other client-side attacks.
Steps to Reproduce:
1. Authenticate to the application as an administrator.
2. Navigate to the User Management section.
3. Create or modify a user record.
4. Insert the following payload into a user-controllable field:
<script>alert(document.domain)</script>
5. Save the record.
6. View the affected user entry.
The injected JavaScript executes automatically, confirming the presence of a Stored Cross-Site Scripting vulnerability. |
|---|
| 원천 | ⚠️ https://medium.com/@gauravkumar67482/authenticated-stored-cross-site-scripting-xss-in-user-management-module-2c2ba72b2cdf |
|---|
| 사용자 | Gaurav kumar (UID 98267) |
|---|
| 제출 | 2026. 06. 10. AM 10:25 (1 월 ago) |
|---|
| 모더레이션 | 2026. 07. 12. PM 06:00 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 377877 [SourceCodester Online Book Store System 1.0 User Management Name/Username 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|