| 标题 | PHPGurukul Cyber Cafe Management System Using PHP & MySQL 1.0 Cross Site Scripting |
|---|
| 描述 | A fundamental web security principle is that all untrusted input must be validated and properly encoded before being included in HTML responses to prevent client-side code execution. However, during the security review it was found that search.php directly echoes the searchdata POST parameter into the page (<h4 align="center">Result against "<?php echo $sdata;?>" keyword </h4>) without any output encoding or sanitization, allowing an attacker to inject HTML/JavaScript that will execute in the context of a victim’s browser. Successful exploitation of this reflected XSS can lead to session cookie theft (if cookies lack HttpOnly), forced actions on behalf of authenticated users, theft of sensitive information visible in the browser, and other client-side attacks that may escalate to account takeover or further lateral misuse. This unchecked reflection substantially increases the application’s attack surface and risk to user confidentiality and trust. |
|---|
| 来源 | ⚠️ https://github.com/r4vindra/Cyber-Cafe-Management-System/blob/main/README.md |
|---|
| 用户 | r4vindra (UID 91109) |
|---|
| 提交 | 2025-09-29 17時12分 (1 年前) |
|---|
| 管理 | 2025-10-13 18時52分 (14 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 327317 [PHPGurukul Cyber Cafe Management System 1.0 POST Parameter /search.php searchdata 跨网站脚本] |
|---|
| 原因 | Vendor source not identifiable. Please reply with website of the responsible vendor. |
|---|
| 积分 | 0 |
|---|