Apartment Visitors Management System Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Apartment Visitors Management System, version 1.1. The issue resides in the 'visname' parameter of 'visitors-form.php'. An authenticated attacker can inject arbitrary JavaScript, which is executed when the malicious input is viewed in 'manage-newvisitors.php' or 'visitor-detail.php'.

Impact

Exploitation of this vulnerability allows for the execution of injected JavaScript in the context of the user's session.

Reproduction

To reproduce this vulnerability, an authenticated user must inject JavaScript into the 'visname' parameter of the 'visitors-form.php' page. Once the input is submitted, the injected script will be executed when the 'manage-newvisitors.php' or 'visitor-detail.php' pages are accessed.