Code-Projects Laundry System Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Code-Projects Laundry System version 1.0. The issue resides in the '/data/edit_laundry.php' file, where the 'customer' parameter is not properly validated before being saved to the database. This flaw allows attackers to inject malicious scripts that are executed in the context of the user's browser, potentially leading to session hijacking and cookie theft.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user, potentially leading to session hijacking and cookie theft.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the 'Edit Laundry' form. Submit the 'Customer Name' field with a script payload, such as a JavaScript alert tag. After submitting the form, refresh the page to trigger the execution of the injected script.