| Название | PHPGurukul Cyber Cafe Management System Using PHP & MySQL 1.0 Cross Site Scripting |
|---|
| Описание | A fundamental web security principle is that all untrusted input must be validated and properly encoded before being included in HTML responses to prevent client-side code execution. However, during the security review it was found that search.php directly echoes the searchdata POST parameter into the page (<h4 align="center">Result against "<?php echo $sdata;?>" keyword </h4>) without any output encoding or sanitization, allowing an attacker to inject HTML/JavaScript that will execute in the context of a victim’s browser. Successful exploitation of this reflected XSS can lead to session cookie theft (if cookies lack HttpOnly), forced actions on behalf of authenticated users, theft of sensitive information visible in the browser, and other client-side attacks that may escalate to account takeover or further lateral misuse. This unchecked reflection substantially increases the application’s attack surface and risk to user confidentiality and trust. |
|---|
| Источник | ⚠️ https://github.com/r4vindra/Cyber-Cafe-Management-System/blob/main/README.md |
|---|
| Пользователь | r4vindra (UID 91109) |
|---|
| Представление | 29.09.2025 17:12 (1 Год назад) |
|---|
| Модерация | 13.10.2025 18:52 (14 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 327317 [PHPGurukul Cyber Cafe Management System 1.0 POST Parameter /search.php searchdata межсайтовый скриптинг] |
|---|
| Причина | Vendor source not identifiable. Please reply with website of the responsible vendor. |
|---|
| Баллы | 0 |
|---|