Listen to this Post
How the CVE Works
The vulnerability in Code-Projects Human Resource Integrated System 1.0 resides in the `/insert-and-view/action.php` file, where improper input sanitization of the `content` parameter allows attackers to inject malicious JavaScript. This leads to stored Cross-Site Scripting (XSS), where the payload executes when an admin or user views the manipulated content. The attack is remotely exploitable with low privileges, requiring only user-level interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) confirms network-based exploitation with low attack complexity.
DailyCVE Form
Platform: Code-Projects HRIS
Version: 1.0
Vulnerability: Stored XSS
Severity: Medium
Date: 08/05/2025
Prediction: Patch by 09/2025
What Undercode Say
Analytics:
curl -X GET "http://target.com/insert-and-view/action.php?content=<script>alert(1)</script>"
SELECT FROM user_data WHERE payload LIKE '%<script>%';
How Exploit
- Craft malicious `content` payload.
- Submit via
/insert-and-view/action.php. - Trigger XSS when admin views logs.
Protection from this CVE
- Sanitize `content` input.
- Implement CSP headers.
- Update to patched version.
Impact:
- Session hijacking.
- Admin credential theft.
- Data manipulation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
