Phproject Stored Cross-Site Scripting Vulnerability in Planned Hours Field

A stored cross-site scripting vulnerability has been identified in Phproject versions 1.8.0 prior to 1.8.3. The issue arises in the Planned Hours field when creating a new project. The vulnerability allows an attacker to inject a malicious script, such as a JavaScript alert, into the planned_hours parameter. This injected script is then executed by the browser when the project creation page is loaded, as the server response does not properly sanitize or encode the input.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, create a new project and enter a script payload, such as a JavaScript alert, in the Planned Hours field. Once the form is submitted, the alert will be triggered, demonstrating that the script has been executed.

Remediation

Users can upgrade to Phproject version 1.8.3 or later to address this vulnerability.