| 标题 | SourceCodester Online Book Store System 1.0 Stored Cross Site Scripting (Stored XSS) |
|---|
| 描述 | A Stored Cross-Site Scripting (Stored XSS) vulnerability was identified in the System Settings module of the Online Book Store System using PHP/MySQLi. The application fails to properly validate and sanitize user-supplied input before storing it in the database. As a result, an authenticated attacker with access to the affected functionality can inject malicious JavaScript payloads that are permanently stored by the application.
Whenever another user or administrator visits the affected page, the injected script is automatically executed in the victim's browser within the application's trusted context. Successful exploitation may allow an attacker to steal session cookies, hijack authenticated sessions, perform unauthorized actions on behalf of the victim, modify application content, or redirect users to malicious websites. If the payload is viewed by an administrator, the vulnerability could lead to full administrative account compromise.
The issue is caused by insufficient input validation and improper output encoding within the System Settings module. Implementing strict server-side input validation, context-aware output encoding, and an appropriate Content Security Policy (CSP) would significantly reduce the risk of exploitation.
Severity: High (may be Critical if exploitable by an administrator and leads to complete application compromise). |
|---|
| 来源 | ⚠️ https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-system-settings-module-fa4f99ed1544 |
|---|
| 用户 | Hemant Raj Bhati (UID 95613) |
|---|
| 提交 | 2026-06-26 14時09分 (2 月前) |
|---|
| 管理 | 2026-08-14 21時28分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 390097 [SourceCodester Online Book Store System 1.0 System Settings index.php?page=site_settings 跨网站脚本] |
|---|
| 积分 | 20 |
|---|