Stored XSS (CWE-79) in PHP app: Weak email regex, missing output encoding & cookie flags

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Stored Cross-Site Scripting (Stored XSS, CWE-79) Severity: High (CVSS 3.1 score 8.0) Root Cause: The field is validated using the loose regex , which allows critical HTML characters such as , , and to pass. When the stored email value is rendered in the DOM within as without HTML escaping, any tags crafted by an attacker are executed as active scripts. Trigger Conditions: The attacker must be logged in as a standard user and submits the email field with the payload in the profile update form. The payload is persisted, and it is triggered for anyone who views that user's profile page. Impact Scope Affected Components: - : Contains the helper function with a weak email regex - : Accepts email input during registration using the same weak regex - : Accepts email input during profile updates using the same weak regex and writes it to the database - : Renders the stored email value as into HTML without output encoding Impact: - Session Hijacking: Since does not have the flag, the XSS script can directly read , exfiltrating the victim's session cookie to an attacker-controlled collector, enabling full session hijacking. - Arbitrary JS Execution: JavaScript runs in the victim's browser, allowing it to read or modify page data, issue requests, and trigger redirects. - Persistence: The payload is stored in the database and is re-executed on every access to the profile page. Remediation 1. Tighten Input Validation: The email regex in should reject , , , , and other critical HTML characters; alternatively, switch to a stricter regex (e.g., ). 2. Output Encoding: Apply or template engine auto-escaping when rendering the email value in . 3. Session Cookie Hardening: Set within so that cookies cannot be read directly even if an XSS occurs. 4. Defense in Depth: Add a header to restrict inline script execution, and configure the session cookie with and . POC / Exploit Code Exploitation Flow: 1. Log in as a standard user. 2. Submit the payload above in the email field of the profile update form. 3. Upon saving, the payload is persisted to the database. 4. When anyone views the user's profile page, the executes in the victim's browser, displaying .

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS (CWE-79) in PHP app: Weak email regex, missing output encoding & cookie flags

More from this source