Stored XSS in SourceCodester Ship/Ferry Ticket Reservation System

Vulnerability Overview Vulnerability Name: Stored Cross-Site Scripting (Stored XSS) Description: A Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the SourceCodester Ship/Ferry Ticket Reservation System due to insufficient sanitization of user-supplied input. Attack Vector: An authenticated attacker can inject malicious JavaScript payloads into application input fields. The application stores these injected payloads and executes them when an affected page is viewed, resulting in arbitrary JavaScript execution within another user's browser. Scope of Impact Application Name: Ship/Ferry Ticket Reservation System – PHP Vendor: SourceCodester Affected Component: User input/Profile functionality Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Potential Impact: May lead to session hijacking, account compromise, credential theft, unauthorized actions, or the execution of malicious scripts in the context of authenticated users. Remediation Input Validation and Output Encoding: Ensure proper sanitization and encoding of user-supplied input to prevent the injection of malicious JavaScript payloads. Methodology: - Authenticate as an administrator - Test input fields - Inject payloads - Verify stored payloads - Validate client-side script execution Proof of Concept (POC) Code Reproduction Steps 1. Log in as an administrator. 2. Navigate to: 3. Create a new user or edit an existing user. 4. Insert the following payload into the username field: 5. Save the user profile. 6. Log out and authenticate using a different user account (administrator or low-privilege user). 7. Observe that the payload is automatically executed within the authenticated page, resulting in a popup window. Detailed Findings Vulnerability Name: Stored Cross-Site Scripting (Stored XSS) Description: The application fails to sanitize user-controlled input, specifically within the username field, during user creation or modification. Attack Vector: An attacker can inject malicious JavaScript payloads into the username parameter via the user management administrative functions. The payload is permanently stored in the database and automatically executed when authenticated users access the affected page. Impact: Since the malicious payload is rendered globally, any authenticated user, including administrators, may be affected by arbitrary JavaScript execution. Conclusion This vulnerability introduces a persistent client-side attack vector that can lead to account compromise and unauthorized actions. It is recommended to remediate this vulnerability as soon as possible to ensure application security.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in SourceCodester Ship/Ferry Ticket Reservation System