| 标题 | sourceCodester Online Leave Management System V1.0 Cross Site Scripting |
|---|
| 描述 | Validation Method
The finding was validated in a local authorized test environment through source code review, HTTP/browser verification, DOM or rendered HTML inspection, and popup screenshot evidence. The payload, affected input, trigger location, and rendered execution context are included below so the issue can be reviewed and reproduced.
Vulnerable Location
Affected File: app/classes/Master.php:300; app/classes/Master.php:302; app/classes/Master.php:305; app/admin/employees/manage_employee.php:94; app/admin/employees/manage_employee.php:100
Affected Component: employee avatar upload extension rendered in hidden field and image src
Vulnerable Parameter / Field: employee avatar filename
Affected Endpoint: POST /classes/Master.php?f=save_employee; render /admin/employees/manage_employee.php?id=12
HTTP Method: POST
Render / Trigger Location: /admin/employees/manage_employee.php?id=12
Authentication Requirement: authenticated admin employee create/update; admin employee edit view triggers
Vulnerability Overview
The Online Leave Management System application does not properly encode or sanitize user-controlled input submitted through employee avatar filename. The value is later rendered in a browser context within /admin/employees/manage_employee.php?id=12, which allows JavaScript execution when the affected page is opened. This results in a filename cross-site scripting vulnerability. |
|---|
| 来源 | ⚠️ https://github.com/cm126261/CVE/issues/1 |
|---|
| 用户 | Smartiesxum (UID 102012) |
|---|
| 提交 | 2026-10-15 13時44分 (25 日前) |
|---|
| 管理 | 2026-11-08 17時40分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 432916 [SourceCodester Online Leave Management System 1.0 Employee Avatar Upload Extension app/classes/Master.php employee avatar filename 跨网站脚本] |
|---|
| 积分 | 20 |
|---|