Submit #897268: code-projects Task Management System in PHP 1.0 Cross Site Scripting

The Task Management System in PHP is potentially vulnerable to Stored Cross-Site Scripting through attacker-controlled filenames supplied to the user profile upload functionality.

The affected endpoint processes multipart/form-data requests containing a profile file field. The filename component of a multipart upload is fully controlled by the client and therefore must be considered untrusted input.

The supplied proof-of-concept request specifies the following filename:

file.txtp5vvr"><img src=a onerror=alert(1)>pshx9
This value contains injected HTML markup with an event-handler attribute:

<img src=a onerror=alert(1)>
If the application saves the original filename in the database or filesystem metadata and later displays that filename within an HTML response without proper encoding, the injected markup may break out of the intended HTML context.

The browser then parses the injected <img> element as active HTML. Because the specified image source cannot be loaded, the element's onerror event handler is triggered and the supplied JavaScript executes in the security context of the Task Management System.

An attacker could exploit the issue by authenticating with a valid account, uploading a profile file containing a malicious filename, and causing another user to access a page that displays the stored filename.

Potentially affected locations may include:

User profile pages
Administrative user-management interfaces
Profile image management pages
Upload history pages
Account listings
Task or project member interfaces
The exact execution location should be identified in the final vulnerability report based on where the payload was observed to execute.

Because the malicious value originates in the filename rather than the contents of the uploaded file, restricting only the uploaded file's MIME type does not prevent this vulnerability. Filenames must independently be treated as attacker-controlled data and safely encoded whenever displayed.

If the filename is stored persistently and executes during subsequent page views, this issue should be classified as Stored Cross-Site Scripting under CWE-79.

• Source: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20via%20Profile%20Image%20Filename%20in%20Task%20Management%20System.md
• User: AhmadMarzouk (UID 95993)
• Submission: 07/20/2026 12:05 (2 months ago)
• Moderation: 09/05/2026 21:03 (2 months later)
• Status: Duplicate
• VulDB entry: 399313 [code-projects Task Management System 1.0 User Profile Update UpdateUserProfile.php lname cross site scripting]
• Points: 0