Submit #897266: code-projects Task Management System In PHP 1.0 Cross Site Scripting

The Task Management System in PHP is potentially vulnerable to Stored Cross-Site Scripting in the password update functionality implemented by the UpdateUserProfile.php endpoint.

The application allows an authenticated user to modify their account password through the password POST parameter. The supplied proof-of-concept request places JavaScript markup inside the submitted password value.

The decoded value is:

123dbjw0<script>alert(1)</script>zdah4
The embedded JavaScript payload is:

<script>alert(1)</script>
If the application stores the original password value directly in the database without secure password hashing and later displays that value in an administrative interface, profile-management page, user listing, debugging interface, or another HTML response, the browser may interpret the injected <script> element as active JavaScript.

In such a scenario, an authenticated attacker could update their password with a malicious payload and cause the application to persist the injected code. When another user, such as an administrator, subsequently views a page containing the stored password value, the JavaScript would execute within the security context of the application.

Successful exploitation could allow execution of arbitrary client-side JavaScript in the browser of affected users. Depending on the victim's privileges and application security controls, this could enable unauthorized actions using the victim's active session, manipulation of displayed content, access to data available to client-side scripts, or phishing attacks.

However, passwords should never normally be rendered back to users in plaintext. A securely designed application should hash passwords using a one-way password hashing algorithm and never retain or display the original password value.

Therefore, this vulnerability should only be classified as Stored XSS if testing confirms all of the following conditions:

The malicious password value is accepted.
The original value is stored persistently.
The stored value is later rendered into an HTML response.
The JavaScript payload executes in a browser.
If the application stores the password using a secure one-way hash such as PHP's password_hash() and never displays the original password, the submitted JavaScript payload cannot result in Stored XSS through this parameter.

• Source: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Task%20Management%20System%20%60password%60%20Parameter.md
• User: AhmadMarzouk (UID 95993)
• Submission: 07/20/2026 12:00 (2 months ago)
• Moderation: 09/05/2026 21:02 (2 months later)
• Status: Duplicate
• VulDB entry: 399313 [code-projects Task Management System 1.0 User Profile Update UpdateUserProfile.php lname cross site scripting]
• Points: 0