Listen to this Post
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the `/view_personnel.php` file of the Employee Profile Management System version 1.0. The application fails to properly sanitize user-controlled input passed through the per_address, dr_school, and `other_school` parameters. An attacker with low-privilege access, such as a standard user account, can inject malicious JavaScript code into these fields. This injected payload is then stored by the system. When an administrator or another user views the personnel details page (/view_personnel.php), the malicious script is retrieved from the database and executed within their browser session. The attack is network-based, requires user interaction (viewing the compromised page), and exploits improper neutralization of input during web page generation. Successful exploitation can compromise data integrity, allow theft of user session information, and manipulate displayed web content.
Platform: Employee Profile Management System
Version: 1.0
Vulnerability : Cross-site scripting
Severity: Medium
date: 2025-12-07
Prediction: No patch available
What Undercode Say:
Analytics: Exploit is publicly.
Bash Commands: `curl -X POST http://
Codes: ``
How Exploit:
An attacker authenticates with low privileges and navigates to the personnel editing or submission form. They inject a malicious script payload into one of the vulnerable parameters (per_address, dr_school, or other_school). The payload is saved to the database. When an administrator views the list or details of personnel via /view_personnel.php, the script executes in the admin’s browser, potentially hijacking their session.
Protection from this CVE
Implement strict input validation.
Apply output encoding/escaping.
Deploy Content Security Policy (CSP).
Sanitize all user inputs.
Upgrade application if patched.
Impact
Low confidentiality impact.
Integrity impact is low.
No availability impact.
Session hijacking risk.
Data integrity compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
