Code-Projects Laundry System Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Code-Projects Laundry System version 1.0. The issue resides in the file '/data/edit_type.php', where the 'type' parameter is not properly validated or sanitized before being saved to the database. This flaw allows attackers to inject malicious scripts that are executed in the context of the user's browser, potentially leading to session hijacking and cookie theft.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the 'Edit Laundry Type' form. Submit the 'Laundry Type' field with a script payload, such as an alert tag. After submitting, refresh the page to trigger the execution of the injected script.