Submeter #1041015: SourceCodester Smart Attendance System with QR Code Scanner 1.0 Cross Site Scripting

Stored cross-site scripting in SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the administrator's browser by registering a student whose full_name contains script; the payload is stored, returned verbatim by the attendance JSON API, and injected into the kiosk DOM via a template literal.

Chain: (1) public student_signup.php stores full_name without validation (lines 20-21, no preg_match/sanitisation); (2) api/attendance_handler.php returns the name unencoded inside JSON (lines 26, 32); (3) scan_attendance.php builds markup with a template literal and prepends it - the JSON field is placed into innerHTML (lines 172-183); the file uses no textContent/createElement anywhere.

CWE-79. CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 5.6.

Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- POST /student_signup.php with full_name=<script>alert('XSS-POC')</script> -> "Registration Successful!" (no validation)
- POST /api/attendance_handler.php student_code=XTEST-001 (no auth) -> {"status":"success",...,"student":"<script>alert('XSS-POC')</script>",...}
- Payload round-trips from the public form through the database into the JSON consumed by the innerHTML sink (sink verified by code inspection).

Impact: arbitrary JavaScript execution in the administrator's authenticated session - session cookie theft (PHPSESSID is not HttpOnly), admin actions performed as the victim, persistent foothold on every kiosk open. The payload is stored and repeats for every admin viewing the scanner.

Remediation: validate/normalise names on input (e.g. ^[\p{L} .'-]{1,80}$/u); build DOM with textContent instead of template literals + innerHTML; set session cookie HttpOnly/SameSite=Strict/Secure.

PoC:
curl -s -X POST "http://<TARGET>/student_signup.php" --data "student_code=STU-2024-001&course=BSIT&section=1-A&full_name=%3Cscript%3Ealert(1)%3C/script%3E&[email protected]"
curl -s -X POST "http://<TARGET>/api/attendance_handler.php" --data "student_code=STU-2024-001"
# kiosk page (admin browser) executes on prepend(html)

White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-04-Stored-XSS-Chain.md

• Fonte: ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-04-Stored-XSS-Chain.md
• Utilizador: yuechuya (UID 101209)
• Submissão: 18/10/2026 10h41 (há 22 dias)
• Moderação: 09/11/2026 17h57 (22 days later)
• Estado: Duplicado
• Entrada VulDB: 408556 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 Self-Registration student_signup.php prepend full_name Script de Site Cruzado]
• Pontos: 0