Listen to this Post
How the CVE Works:
The vulnerability exists in the Online Banking System 1.0 by SourceCodester, specifically within the user profile page accessible via the `/index.php?page=user` endpoint. Attackers can exploit this by injecting malicious JavaScript code into the “First Name” or “Last Name” parameters during user input or modification. This input is not properly sanitized or validated by the application, allowing the injected script to be stored or reflected. When other users, such as administrators, view the compromised user profile, the script executes in their browser context. The attack is launched remotely without requiring authentication, as it targets authenticated user sessions. This cross-site scripting (XSS) flaw enables attackers to steal session cookies, redirect users to malicious sites, or perform actions on behalf of the user. The exploit is public, increasing the risk of widespread abuse. The vulnerability stems from weak input handling in PHP scripts that display user data without encoding. It affects the core banking functionality, potentially compromising customer data and transactions. The CVSS score indicates medium severity due to the need for user interaction and limited impact on confidentiality. However, in banking contexts, even medium-severity XSS can lead to significant fraud. The manipulation of arguments via GET or POST requests triggers the issue, and no CSRF protections are bypassed. The flaw is persistent if data is stored, but details on storage are unclear. Overall, this CVE highlights common web security failures in small-scale banking software.
DailyCVE Form:
Platform: SourceCodester Banking System
Version: 1.0
Vulnerability: XSS
Severity: Medium
Date: 12/08/2025
Prediction: Patch expected 2026-01
What Undercode Say:
Analytics:
curl -X POST -d "first_name=<script>alert('XSS')</script>" http://target/?page=user
<input type="text" name="last_name" value=""><img src=x onerror=stealCookies()>
grep -r "page=user" /var/www/html/
How Exploit:
Inject malicious scripts into First Name/Last Name fields via HTTP requests to hijack sessions or deface pages.
Protection from this CVE:
Sanitize user input, implement Content Security Policy, update to patched version.
Impact:
Session theft, data compromise, unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
