Code-Projects Student Information System Cross-Site Scripting Vulnerability in register.php

A cross-site scripting (XSS) vulnerability has been identified in Code-Projects Student Information System version 2.0, specifically within the register.php file. This vulnerability allows for unrestricted XSS, leading to stored XSS attacks. Exploitation of this issue can be done remotely, and it has been publicly disclosed with an available proof-of-concept exploit.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, register a new account using the username parameter with a script payload, such as a JavaScript alert tag. After registration, log into the account. The injected script will execute, demonstrating the cross-site scripting vulnerability.