SourceCodester Online Book Store System Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in SourceCodester Online Book Store System version 1.0, specifically within the User Management Module. This issue arises from improper handling of the Name/Username input, allowing authenticated users to inject malicious JavaScript that is permanently stored and executed when the page is accessed by other users. The vulnerability could be exploited remotely, with the injected scripts running in the context of the user’s session.

Impact

Exploitation of this vulnerability allows for the execution of injected JavaScript in the context of authenticated users, potentially leading to session hijacking, unauthorized actions, and modification of application content. If the injected script is executed during an active administrator session, it could result in a compromise of that session.

Reproduction

To reproduce this vulnerability, log into the application and navigate to the User Management section. Create a new user or edit an existing one, and insert a script payload into the User Name field. After saving the record, return to the user listing page or reopen the modified user record to see the injected script execute in the browser.

Remediation

It is recommended to implement input validation to reject harmful HTML content, apply a Content Security Policy to mitigate XSS risks, and use established output encoding libraries.