SourceCodester Best Employee Management System Cross-Site Scripting Vulnerability in Add Role Page

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester Best Employee Management System version 1.0. The issue arises in the Add Role Page, specifically within the file '/admin/Operations/Role.php'. The vulnerability is triggered by manipulating the 'assign_name' or 'description' arguments, allowing for the execution of malicious scripts. This issue can be exploited remotely, but requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the Role Management tab and add a new role. The application permits the entry of unsafe characters, such as script tags. Since the application's protection is only client-side, this can be done using a proxy tool like Burp Suite to intercept and modify the request. Once the payload is injected, the script will execute each time the Role Management tab is accessed.