Submit #896153: code-projects Task Management System In PHP 1.0 Cross Site Scripting

The Task Management System in PHP is vulnerable to Stored Cross-Site Scripting in the user profile update functionality implemented by the UpdateUserProfile.php endpoint.

The application allows authenticated users to modify profile information through the fname and lname parameters. The lname parameter accepts user-controlled input that may contain HTML and JavaScript markup.

The supplied request submits a last-name value containing:

<script>alert(1)</script>
If this value is accepted and stored by the application without adequate validation or sanitization, it becomes persistent application data.

When the stored last name is subsequently retrieved from the database and inserted into an HTML page without proper contextual output encoding, the browser interprets the injected <script> element as executable content instead of displaying it as plain text.

An attacker can therefore modify their profile and place a malicious JavaScript payload in the lname field. The payload may then execute whenever another user visits a page that displays the attacker's stored profile information.

Potentially affected locations may include:

User profile pages
User-management interfaces
Task assignment pages
Project member lists
Administrative dashboards
Activity or account listings
The exact execution location should be documented based on the page where the stored value was observed to execute.

Successful exploitation may allow an attacker to execute arbitrary JavaScript within the origin of the Task Management System in the browser of another authenticated user.

Depending on the victim's privileges and the application's security controls, this may allow unauthorized actions to be performed using the victim's active session, manipulation of displayed application content, access to information available to client-side scripts, or phishing and interface-redressing attacks.

The vulnerability results from inadequate handling of user-controlled profile data. User input should be validated according to the expected format and, critically, encoded according to the output context whenever it is rendered.

Because the injected payload is stored by the application and may execute during later requests, this issue should be classified as Stored Cross-Site Scripting (Stored XSS) if persistence and execution have been confirmed.

• Source: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Task%20Management%20System%20%60lname%60%20Parameter.md
• User: AhmadMarzouk (UID 95993)
• Submission: 07/19/2026 20:39 (2 months ago)
• Moderation: 09/05/2026 12:46 (2 months later)
• Status: Accepted
• VulDB entry: 399313 [code-projects Task Management System 1.0 User Profile Update UpdateUserProfile.php lname cross site scripting]
• Points: 20