| Título | GitHub MD-MAFUJUL-HASAN/Online-Payroll-Management-System 1.0 Cross Site Scripting |
|---|
| Descrição | ### VULNERABILITY DESCRIPTION:
A **Stored Cross-Site Scripting (XSS)** vulnerability was discovered in the **Online-Payroll-Management-System** . The application fails to properly sanitize or neutralize user-supplied input before rendering it back onto the webpage. An attacker can exploit this weakness by injecting a malicious script into the vulnerable input box **chat** located within the chat.php script. This allows the execution of arbitrary JavaScript code in the context of an unsuspecting user's browser session whenever they view the affected account profile page.
### PROOF OF CONCEPT (PoC) / REPRODUCTION STEPS:
1. clone the reporsitory by the below command
`git clone https://github.com/MD-MAFUJUL-HASAN/Online-Payroll-Management-System.git`
2. Then create an database and then fill the database with the sql file in the repository
`mariadb -e "CREATE DATABASE IF NOT EXISTS payrollmanage;"`
`mariadb payrollmanage < Online-Payroll-Management-System/payrollmanage.sql`
3. Then replace the chat.php file with the below file
[chat.php](https://gist.github.com/dext34-morgan/63b90dcb293789542e49b6d1d1728882)
4. Then start the php web server with the below command
`php -S localhost:8000`
5. Then login with the below credentials
Username - [email protected]
Password - Admin@123
6. Then visit the below url...
http://localhost:8000/chat.php?id=2
7. Then add the payload in the start typing box and then hit the send button
Payload:
```"<script>alert(document.cookie)</script>```
<img width="2878" height="1722" alt="Image" src="https://github.com/user-attachments/assets/ee5a10dd-255a-432b-8804-3196095c058b" />
8. Then an alert box will appear with the cookie id
<img width="2880" height="806" alt="Image" src="https://github.com/user-attachments/assets/5896cbf1-bfd9-46db-988a-839d2a6d80fa" />
And this is Stored XSS so even after stopping the webserver the vulnerability is still exploited. Fix the vulnerability as soon as possible.
|
|---|
| Fonte | ⚠️ https://github.com/MD-MAFUJUL-HASAN/Online-Payroll-Management-System/issues/2 |
|---|
| Utilizador | dexter-morgan (UID 100687) |
|---|
| Submissão | 11/10/2026 12h15 (há 17 dias) |
|---|
| Moderação | 26/10/2026 19h11 (15 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 426580 [MD-MAFUJUL-HASAN Online-Payroll-Management-System até a8902bf64575e325f6d6bf93a55f7bd273ec58cd chat.php id Script de Site Cruzado] |
|---|
| Pontos | 20 |
|---|