Code-Projects Online Reviewer System Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Code-Projects Online Reviewer System in PHP, version 1.0. The issue resides in the file '/system/system/students/assessments/databank/btn_functions.php', where user input in the 'description' parameter is not properly validated or encoded before being saved to the database. This unfiltered input is later displayed in the application interface, allowing attackers to inject malicious HTML or JavaScript. Exploitation of this vulnerability could lead to session hijacking or unauthorized actions within the application.

Impact

Exploitation of this vulnerability allows for the execution of injected JavaScript in the browsers of users viewing the affected content. This could result in the theft of authentication cookies, hijacking of administrator sessions, and unauthorized actions within the application. Additionally, injected content could disrupt exam questions or facilitate phishing attacks against users.

Reproduction

To reproduce this vulnerability, log into the application as an administrator and navigate to the question update page. Intercept the update request using a tool like Burp Suite. Insert a malicious payload, such as a JavaScript injection, into the 'description' parameter and submit the request. When the question is viewed later, the injected script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

It is recommended to sanitize and validate user input before storing it in the database, use prepared statements for database queries to prevent injection attacks, and implement output encoding to ensure that user-generated content is safely displayed in the application interface.