| Title | PHPGurukul Company Visitor Management System PHP V2.0 Stored Cross-Site Scripting (CWE-79) |
|---|
| Description | During the security review of "Company Visitor Management System PHP V2.0", I discovered a stored Cross-Site Scripting vulnerability in the "/manage-newvisitors.php" file. This vulnerability stems from insufficient input validation and output encoding of the 'fullname' parameter. The data flow is as follows: (1) '/visitors-form.php' accepts the 'fullname' parameter from a POST request and inserts it directly into the database via an unsanitized SQL INSERT query; (2) '/manage-newvisitors.php' retrieves the stored data with a SQL SELECT query and echoes it into an HTML table using raw PHP echo statements without htmlspecialchars() or any other output encoding. An attacker who can submit a visitor record (authenticated admin, or unauthenticated via the SQL injection login bypass in /index.php) can store a JavaScript payload in the FullName field. The script then executes in the browser of any administrator who views the visitor list, search results, visitor details, or date range reports. Immediate remedial measures are needed to ensure system security and protect data integrity. |
|---|
| Source | ⚠️ https://github.com/mzxqqwq/CVE/issues/3 |
|---|
| User | mzxqqwq (UID 99169) |
|---|
| Submission | 06/21/2026 13:55 (2 months ago) |
|---|
| Moderation | 08/07/2026 10:12 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 386952 [PHPGurukul Company Visitor Management System 1.0 /manage-newvisitors.php fullname cross site scripting] |
|---|
| Points | 20 |
|---|