| 제목 | code-projects Online Shopping System In PHP With Source Code 1.0 Cross Site Scripting |
|---|
| 설명 | The Online Shopping System in PHP v1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the newsletter subscription functionality implemented by the offersmail.php endpoint.
The vulnerability exists because the application accepts user-supplied input through the email parameter and stores it without performing adequate server-side validation or sanitization. When the stored email address is subsequently displayed within the administrative interface or any page that lists newsletter subscribers, the application renders the stored value directly into the HTML response without applying proper contextual output encoding.
An attacker can exploit this issue by submitting a specially crafted JavaScript payload in the email parameter when subscribing to promotional offers. The malicious input is permanently stored by the application and remains associated with the subscriber record. Whenever an administrator or another privileged user accesses a page displaying the stored email address, the browser interprets the injected content as active code and executes it within the security context of the application.
The vulnerability is caused by insufficient validation of user-controlled input before storage and the failure to encode stored data before rendering it in HTML. Because the malicious payload persists in the application's backend storage and executes whenever the affected record is viewed, the issue is classified as a Stored (Persistent) Cross-Site Scripting (XSS) vulnerability.
Successful exploitation may allow an attacker to execute arbitrary JavaScript in the browser of authenticated users, potentially leading to session hijacking, theft of authentication cookies, execution of unauthorized actions on behalf of the victim, modification of application content, phishing attacks, or compromise of administrative accounts. Since the payload remains stored until it is removed, every privileged user who views the affected subscriber entry may be exposed to the attack. |
|---|
| 원천 | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Shopping%20System%20PHP%20email%20Parameter.md |
|---|
| 사용자 | AhmadMarzook (UID 96211) |
|---|
| 제출 | 2026. 07. 17. PM 08:56 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. PM 08:16 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397189 [code-projects Online Shopping System 1.0 Newsletter Subscription /offersmail.php email 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|