Code-Projects Laundry System Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Code-Projects Laundry System version 1.0. The issue resides in the file '/data/insert_laundry.php', where the 'customer' parameter is manipulated, leading to the injection of malicious scripts. This vulnerability allows attackers to execute scripts in the context of the user’s browser, potentially stealing cookies and hijacking sessions.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, submit the 'Customer Name' field in the 'insert_laundry.php' file with a script payload, such as an alert script. After submitting, refresh the page to trigger the execution of the injected script.