Code-Projects Student Information Management System Cross-Site Scripting Vulnerability in Login.php

A cross-site scripting vulnerability has been identified in version 1.0 of the Code-Projects Student Information Management System. The issue resides in the login.php file, where the uname parameter is not properly validated, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely and has been made public.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

The vulnerability can be reproduced by sending a POST request to the login.php file with a crafted uname parameter that includes the injected script or payload. This can be done using tools like sqlmap, which automates the process of finding and exploiting SQL injection vulnerabilities.