| tiêu đề | code-projects The Social Networking Site in PHP 1.0 Cross Site Scripting |
|---|
| Mô tả | The Social Networking Site in PHP version 1.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the post content functionality.
The issue occurs because the application fails to properly sanitize or encode user-controlled input before storing it in the database and rendering it in the HTML response.
The vulnerable code renders the post content directly:
<div class="alert"><?php echo $row['content']; ?></div>
The content parameter is stored in the post database table and later displayed in the social feed without output encoding. Because the value is inserted directly into the HTML page, malicious HTML or JavaScript code may be interpreted and executed by the browser.
An attacker can exploit this vulnerability by submitting a specially crafted payload when creating a post. The injected payload becomes persistent in the database and is executed whenever the affected page is viewed by other users.
Example payload used during testing:
<details/open/ontoggle=prompt(origin)>
Successful exploitation allows attackers to execute arbitrary JavaScript within the context of the application, which may lead to session hijacking, cookie theft, or performing actions on behalf of authenticated users. |
|---|
| Nguồn | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20PHP%20Social%20Networking%20Site.md |
|---|
| Người dùng | AhmadMarzook (UID 96211) |
|---|
| Đệ trình | 11/03/2026 18:06 (cách đây 5 các tháng) |
|---|
| Kiểm duyệt | 27/03/2026 09:51 (16 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 353856 [code-projects Social Networking Site 1.0 Alert /home.php content Tập lệnh chéo trang] |
|---|
| điểm | 20 |
|---|