| 제목 | code-projects Human Resource Management In PHP 1.0 Cross Site Scripting |
|---|
| 설명 | The Human Resource Management System in PHP is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the event creation functionality.
The vulnerability occurs when the application processes user-controlled input supplied through the eventSubject parameter and stores the submitted value through the following component:
/humanresourcemanagementsystem/src/store/EventStore.php The application accepts attacker-controlled input containing HTML markup. If the submitted value is stored and subsequently rendered within the application interface without proper context-aware output encoding, an attacker can inject malicious HTML or JavaScript-capable markup that executes in the browser of users viewing the affected event.
Testing confirmed that the following payload could be submitted through the eventSubject parameter:
<details/open/ontoggle=prompt(origin)> Because the malicious value is stored server-side and can execute when the affected content is subsequently rendered, the vulnerability is classified as a Stored (Persistent) Cross-Site Scripting vulnerability.
An attacker with access to the event creation functionality could potentially exploit this issue to execute arbitrary JavaScript in the browser of other users who view the malicious event. |
|---|
| 원천 | ⚠️ https://github.com/ahmad-masa100/CVEsmasa100/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Human%20Resource%20Management%20System%20in%20PHP.md |
|---|
| 사용자 | ahmad-masa10 (UID 101137) |
|---|
| 제출 | 2026. 09. 09. PM 06:17 (25 날 ago) |
|---|
| 모더레이션 | 2026. 10. 04. AM 10:34 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413405 [code-projects Human Resource Management 1.0 Event Creation EventStore.php eventSubject 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|