Blood Bank Management System Cross-Site Scripting Vulnerability in abs.php

A cross-site scripting (XSS) vulnerability has been identified in the Blood Bank Management System, specifically within the abs.php component. The issue arises because the application does not adequately sanitize or encode user input before displaying it. This allows attackers to inject malicious JavaScript into the msg parameter, which is executed in the browser of anyone who views the page.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the Blood Bank Management System and navigate to the abs.php page. Inject a script into the msg parameter, such as a script tag containing JavaScript code, such as an alert displaying the document.cookie. Once the page is loaded, the injected script will execute, demonstrating the cross-site scripting vulnerability.