| 标题 | ProjectWorlds Online Examination System Project in Php Mysql 1.0 Cross Site Scripting |
|---|
| 描述 | The feedback form in feedback.php does not sanitize or encode user-supplied input in the "Name" and "Subject" fields before storing them in the database. When an authenticated administrator navigates to their dashboard and opens the Feedback section (dash.php?q=3), the stored payload executes in the admin's browser session.
Steps to Reproduce:
Navigate to http://<target>/online-examination-systen-in-php-master/feedback.php
Fill in the feedback form:
Name: <script>alert(99)</script>
Subject: <script>alert(99)</script>
E-Mail address: any valid-looking email (e.g. [email protected])
Message: any value (optional additional payload e.g. 1");alert(document.cookie);//)
Click Submit — the payload is stored in the backend database without sanitization.
Log in as an administrator and navigate to dash.php?q=3 (Feedback section of the admin dashboard).
The stored payload executes immediately upon page load — confirmed by JavaScript alert(99) popup firing in the admin's session context.
Attack Vector: Remote, unauthenticated (feedback form requires no login to submit)
Privileges Required: None (attacker) / the victim must be an authenticated admin
User Interaction: Required — admin must open the Feedback tab in the dashboard
Impact: Since the payload executes in the admin's authenticated session, an attacker can escalate to session/cookie theft (document.cookie), CSRF-token exfiltration, admin account takeover, or full admin panel compromise via chained payloads (e.g. auto-submitting forms).
CVSS 3.1 Vector (suggested): AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Remediation: Apply htmlspecialchars() (or equivalent output encoding) to Name, Subject, and all feedback fields both at storage time and at render time in dash.php.
Discoverer: Shailendra Mourya (CyberShailendra ) |
|---|
| 来源 | ⚠️ https://github.com/CyberShailendra1/Online-Examination-System-Project |
|---|
| 用户 | CyberShailendra (UID 99999) |
|---|
| 提交 | 2026-07-22 07時17分 (2 月前) |
|---|
| 管理 | 2026-09-06 10時44分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 399395 [projectworlds Online Examination System 1.0 Feedback Form feedback.php Name/Subject 跨网站脚本] |
|---|
| 积分 | 20 |
|---|