SourceCodester API Key Manager App Cross-Site Scripting Vulnerability in Import Key Handler

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester API Key Manager App version 1.0. The issue arises in the Import Key Handler component, where user input is not properly sanitized before being outputted as a web page, allowing for the execution of JavaScript payloads in the victim's browser. This vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, import a JSON file through the 'Import Key' feature that includes a JavaScript payload, such as an image tag with an 'onerror' event. The application will execute the script in the browser, demonstrating the cross-site scripting vulnerability.