# CVE-2025-56243 - Reflected XSS in PuneethReddyHC / Event Management System (v1.0)
**Title:** Reflected Cross-Site Scripting (XSS) via `event_id` parameter in `register.php`
**Vendor / Repository:** [PuneethReddyHC / event-management](https://github.com/PuneethReddyHC/event-management)
**Affected Version:** 1.0 (branch/tag `master` at the time of testing)
**Reporter:** Hafiz Pradana Gemilang
**Disclosure Status:** Vendor notified privately — exploit PoC withheld for user safety.
Status and timeline will be updated after coordination or patch release.
---
## Summary
A **Reflected Cross-Site Scripting (XSS)** vulnerability was identified in `register.php`, where the `event_id` GET parameter is not properly sanitized before being reflected into the page output.
A remote attacker can craft a malicious URL that executes arbitrary JavaScript in the victim’s browser once they visit or are redirected to the link.
> ⚠️ This advisory intentionally omits an active exploit payload.
> The full proof-of-concept has been provided privately to the vendor for patch development.
---
## Affected Endpoint
```
/register.php?event_id=<value>
```
Example (local testing):
```
http://<host>/event-management-master/register.php?event_id=1
```
---
## Vulnerability Type
- **Type:** Reflected Cross-Site Scripting (XSS) — client-side script injection
- **Attack Vector:** Remote (crafted link or redirect)
- **User Interaction:** Required (victim clicks the link or is redirected)
---
## Impact
Successful exploitation allows arbitrary JavaScript execution in the context of the affected domain.
Potential consequences:
- Session or token theft (if cookies are not `HttpOnly`)
- Phishing or fake UI injection
- Data exfiltration from the DOM
- Unauthorized actions on behalf of the victim (if chained with other flaws)
**Estimated CVSS v3.1:** 6.1 (Medium) — `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`
---
## Reproduction (High-Level Overview)
1. An attacker crafts a URL containing a JavaScript payload within the `event_id` parameter.
2. The victim opens the link.
3. The server reflects the unescaped parameter into the HTML response.
4. The browser parses and executes the injected script.
> Full payload and proof-of-concept have been shared privately with the vendor.
> If you are the maintainer and require access, please contact the reporter (see below).
---
## Mitigation & Recommended Fix
Apply **server-side validation and output encoding** to prevent reflected XSS.
1. **Input Validation**
If `event_id` is numeric, enforce numeric validation:
```php
$event_id = filter_input(INPUT_GET, 'event_id', FILTER_VALIDATE_INT);
if ($event_id === false) {
// handle invalid input
}
```
2. **Output Encoding**
Escape user-supplied data before printing to HTML:
```php
echo htmlspecialchars($event_id, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
```
3. **Use Secure Frameworks or Templates**
Prefer frameworks that automatically perform context-aware escaping.
4. **Secure Cookies**
Set `HttpOnly`, `Secure`, and `SameSite` flags on session cookies.
5. **Content Security Policy (CSP)**
Apply a strict CSP and avoid using `unsafe-inline`.
6. **Code Review & Audit**
Check all other reflected parameters throughout the application.
---
## Example Patch (Simplified)
```php
// Validate numeric input
$event_id = filter_input(INPUT_GET, 'event_id', FILTER_VALIDATE_INT);
if ($event_id === false || $event_id === null) {
$event_id = 0; // or display an error / redirect
}
// Safe output
?>
<span id="event-id"><?= htmlspecialchars($event_id, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') ?></span>
<?php
```
---
## References
- OWASP: [Cross-Site Scripting (XSS)](https://owasp.org/www-community/attacks/xss/)
- PHP `htmlspecialchars()` Docs: https://www.php.net/manual/en/function.htmlspecialchars.php
---
## Credits / Contact
**Reported by:** Hafiz Pradana Gemilang
- Email: hafizpradana.gemilang21@gmail.com
- GitHub: (https://github.com/hafizgemilang)
Vendor: [PuneethReddyHC / event-management](https://github.com/PuneethReddyHC/event-management)
---
### Disclaimer
This advisory omits detailed exploit code to protect users of the affected software.
Full technical details are available to the vendor or authorized coordinators upon request under responsible disclosure terms.
---
[4.0K] /data/pocs/6312c9a7ea5cab8a73d423b0e0534177b48c53e0
└── [4.3K] README.md
1 directory, 1 file