Stored XSS in PHPGurukul Company Visitor Management System V2.0

Vulnerability Overview Vulnerability Name: PHPGurukul Company Visitor Management System PHP V2.0 /manage-newvisitors.php Stored Cross-Site Scripting (XSS) #3 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS, CWE-79) Affected Product: Company Visitor Management System PHP Affected Version: V2.0 Vulnerable File: /manage-newvisitors.php Software Link: https://phpgurukul.com/company-visitor-management-system-using-php-and-mysql/ Impact Scope Vulnerability Description: A Stored Cross-Site Scripting (XSS) vulnerability was identified in the “/manage-newvisitors.php” file of “Company Visitor Management System PHP V2.0”. This vulnerability stems from insufficient input validation and output encoding of the “fullname” parameter. Attackers can inject malicious JavaScript code via the “/visitors-form.php” entry point. This data is directly stored in the database without any input validation or sanitization. When the stored data is retrieved and output to HTML in “/manage-newvisitors.php” without any encoding or escaping, attackers can inject arbitrary JavaScript code that executes in the browser of administrators viewing the visitor list. Impact: Attackers can leverage this Stored XSS vulnerability to steal administrator session cookies, perform unauthorized actions as an authenticated administrator, redirect users to phishing sites, disrupt the application, or inject keyloggers and other malicious scripts. Since the XSS triggers on the visitor management page—a core administrative interface viewed by all administrators—the likelihood of exploitation is high. This could lead to complete account takeover and compromise the security of the entire visitor management system. Remediation Measures 1. Implement Output Encoding: Use for all variables echoed into the HTML context. This is the primary and most critical fix. It should be applied consistently to all echo/print statements outputting user-controlled data. 2. Implement Input Validation: Validate and sanitize all user input before storing it in the database. Reject or strip HTML tags from fields that should contain only plain text (e.g., FullName, Address). 3. Implement Content Security Policy (CSP): Add strict Content Security Policy headers to prevent inline script execution, even if XSS injection succeeds. 4. Set Session Cookie Flags: Set the HttpOnly and Secure flags on session cookies to prevent JavaScript from reading , thereby mitigating session cookie theft via XSS. 5. Use Auto-Escaping Template Engines: Consider using template engines that auto-escape output (e.g., Twig, Blade) instead of raw PHP echo statements. 6. Regular Security Audits: Conduct regular code and system security audits to promptly identify and remediate potential security vulnerabilities, paying particular attention to input/output handling across all endpoints. POC Code Entry Point: Lines 12-20 Trigger Point: Lines 96-107 Payload: Alternative payloads (without single quotes): Affected Triggering Pages (Same Stored XSS, Different View Contexts) Test and Run Screenshots Step 1: Enter XSS payload in Step 2: Navigate to — Cookie Alert Triggers Step 3: Navigate to — Alert Triggers Again Recommended Remediation 1. Implement Output Encoding: Use for all variables echoed into the HTML context. This is the primary and most critical fix. It should be applied consistently to all echo/print statements outputting user-controlled data. 2. Implement Input Validation: Validate and sanitize all user input before storing it in the database. Reject or strip HTML tags from fields that should contain only plain text (e.g., FullName, Address). 3. Implement Content Security Policy (CSP): Add strict Content Security Policy headers to prevent inline script execution, even if XSS injection succeeds. 4. Set Session Cookie Flags: Set the HttpOnly and Secure flags on session cookies to prevent JavaScript from reading , thereby mitigating session cookie theft via XSS. 5. Use Auto-Escaping Template Engines: Consider using template engines that auto-escape output (e.g., Twig, Blade) instead of raw PHP echo statements. 6. Regular Security Audits: Conduct regular code and system security audits to promptly identify and remediate potential security vulnerabilities, paying particular attention to input/output handling across all endpoints.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in PHPGurukul Company Visitor Management System V2.0

More from this source