提交 #764397: SourceCodester Accounts Manager App Using PHP and MySQL 1.0 Stored Cross Site Scripting (XSS)

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Accounts Manager App Using PHP and MySQL version 1.0.

The vulnerability occurs in the Add Account functionality.

Vulnerable Input Endpoint:
POST /account-manager-app/endpoint/add-account.php

Vulnerable Output Location:
GET /account-manager-app/index.php

User input supplied in the following fields is not properly sanitized before being stored in the database and rendered in the main dashboard:

* Account Name
* Username
* URL

An attacker can inject malicious JavaScript payload which will be stored permanently and executed whenever the data is viewed in the application.

Proof of Concept (PoC):

1. Open the application:
http://localhost/account-manager-app/

2. Click on **Add Account**

3. Insert the following payload in the Account Name or URL field:

<script>alert(1)</script>

OR

" autofocus onfocus=alert(1) x="

4. Click **Save Account**

5. After saving, return to the main dashboard.

6. The JavaScript payload executes automatically when the stored data is rendered, confirming a Stored Cross-Site Scripting vulnerability.

Impact:

* Execution of arbitrary JavaScript in the victim's browser
* Session hijacking
* Credential theft
* Account takeover
* Defacement or malicious redirection

The issue occurs due to missing input validation and output encoding.

Recommended Fix:

* Implement proper input validation and sanitization
* Apply output encoding (e.g., htmlspecialchars in PHP)
* Use a Content Security Policy (CSP)

• 来源: ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-accounts-manager-app-using-php-and-mysql-sourcecodester-ab557de210bb
• 用户: Hemant Raj Bhati (UID 95613)
• 提交: 2026-02-20 19時59分 (8 月前)
• 管理: 2026-03-02 20時45分 (10 days later)
• 状态: 重复
• VulDB条目: 274368 [SourceCodester Accounts Manager App 1.0 add-account.php account_name 跨网站脚本]
• 积分: 0