Submit #906285: SourceCodester Dynamic Input Field Generator Using HTML, Bootstrap5, MySQLi and PHP with Source Code 1.0 Cross Site Scripting (Stored)

The "Dynamic Input Field Generator Using HTML, CSS, and PHP" application (SourceCodester) accepts an arbitrary number of user-supplied text values via a POST parameter (person[]) on public/index.php, processed by public/submit.php. Each submitted value is passed to saveUser() in includes/queries.php and inserted into the person table (person_name column) using a parameterized query. While this prevents SQL injection, no input validation or output encoding is applied anywhere in the codebase. The array key used in the error-reporting branch of submit.php is escaped with htmlspecialchars(), but the actual user-controlled value ($val) is never sanitized at any point in the input→storage→(future) output pipeline. The application ships without a page that redisplays stored records, but any listing/view feature added to the project — a standard and expected extension of this app's functionality — will echo the raw stored value and execute injected script in the browser of any visitor. This constitutes a stored/persistent Cross-Site Scripting vulnerability rooted in the application's data-handling design (CWE-79).

Proof of Concept

Submit the form at public/index.php with the input value:
html
<script>alert('XSS-PoC')</script>
Verify the payload is stored unmodified:
sql
SELECT * FROM person;
-- person_name contains the literal <script> tag, unescaped
Load a representative display page reflecting this data (consistent with the app's existing style):
php
<?php
require_once __DIR__ . '/../config/db.php';
$result = $mysqli->query("SELECT person_name FROM person");
while ($row = $result->fetch_assoc()) {
echo "<p>" . $row['person_name'] . "</p>";
}
Result: the injected script executes on page load (alert('XSS-PoC') fires), confirming the stored value is emitted without encoding.

Note: the display page in step 3 is not shipped by the vendor; it demonstrates the exploitable consequence of the vendor's unsanitized storage design.

Impact

No authentication is required to submit malicious input, since the form is publicly accessible.
Any future or forked page that lists, exports, or displays stored person_name values will execute attacker-controlled JavaScript for every visitor.
Potential consequences include session/cookie theft, credential phishing via injected fake UI elements, page defacement, and privilege escalation if an administrator views the affected listing page.
Persistent nature (stored, not reflected) means a single successful submission affects all future viewers until the record is removed from the database.

Mitigation

Output encoding (primary fix): apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to all stored user data before rendering in any HTML context.
Input validation (defense in depth): in submit.php, trim input, strip tags, and enforce a max length matching the varchar(255) column:
php
$person = trim(strip_tags($val));
if ($person === '' || strlen($person) > 255) {
$errors[] = "Invalid input.";
continue;
}
Adopt a consistent output-encoding convention project-wide (e.g., a shared e() helper function) so future pages inherit safe-by-default rendering.
Consider a Content-Security-Policy header as a secondary layer of defense against script execution.

CVE Severity

CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1 Score: 6.1 (Medium)
Rationale: Network-exploitable, low attack complexity, no privileges required, but requires user interaction (a victim must view the affected page); scope is changed (impact extends beyond the vulnerable component to the victim's browser session); confidentiality and integrity impact are limited (typical of client-side script execution), no availability impact.

• Source: ⚠️ https://www.exploit-db.com/exploits/52057
• User: Muhammed Hashir (UID 100142)
• Submission: 07/27/2026 11:09 (2 months ago)
• Moderation: 09/06/2026 18:02 (1 month later)
• Status: Duplicate
• VulDB entry: 255828 [Customer Support System 1.0 index.php?page=new_ticket subject cross site scripting]
• Points: 0