| Название | SourceCodester Online Book Store System 1.0 Stored Cross-Site Scripting (Authenticated) |
|---|
| Описание | An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists in the User Management module of the Online Book Store Management System developed by SourceCodester.
The application fails to properly sanitize user-supplied input before storing and rendering it within administrative interfaces. An authenticated administrator can inject arbitrary JavaScript code into user-controllable fields. The malicious payload is stored in the backend database and executed whenever the affected record is viewed.
Successful exploitation allows execution of arbitrary JavaScript in the context of the application, potentially leading to session hijacking, unauthorized actions, user impersonation, interface manipulation, and other client-side attacks.
Steps to Reproduce:
1. Authenticate to the application as an administrator.
2. Navigate to the User Management section.
3. Create or modify a user record.
4. Insert the following payload into a user-controllable field:
<script>alert(document.domain)</script>
5. Save the record.
6. View the affected user entry.
The injected JavaScript executes automatically, confirming the presence of a Stored Cross-Site Scripting vulnerability. |
|---|
| Источник | ⚠️ https://medium.com/@gauravkumar67482/authenticated-stored-cross-site-scripting-xss-in-user-management-module-2c2ba72b2cdf |
|---|
| Пользователь | Gaurav kumar (UID 98267) |
|---|
| Представление | 10.06.2026 10:25 (1 месяц назад) |
|---|
| Модерация | 12.07.2026 18:00 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 377877 [SourceCodester Online Book Store System 1.0 User Management Name/Username межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|