CVE-2023-34648: Common-Vulnerabilities-and-Exposures/CVE-2023-34648 at main · ckalnarayan/Common-Vulnerabilities-and-Exposures

# User Registration login and user management system with admin panel v.1.0 - Stored Cross-Site Scripting (XSS)Vulnerability

## Stored Cross Site Scripting Vulnerability found in User Registration login and user management system with admin panel v.1.0

Vulnerability Description -

The User Registration login and user management system with admin panel v.1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application.

Steps to Reproduce -

The following steps demonstrate how to exploit the Stored XSS vulnerability in the Hostel Management System v.1.0:

1. Visit the User Registration login and user management system with admin panel v.1.0 application by accessing the URL: http://localhost/loginsystem/signup.php

2. Click on the “Sign Up” and Creat New User Account

“First Name” “Last Name” field, inject the following XSS payload, enclosed in brackets: {"><script>alert(“XSS”)</script>}.

3. Click on the “Submit” button.

4. Login to the Account using the Email id and Password Which You Have Entered, injected payload will be executed.

As a result of successful exploitation, the injected JavaScript code will be stored in the application’s database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text “XSS.” This allows the attacker to execute arbitrary code within the user’s browser, potentially leading to further attacks or unauthorized actions.

**Reference: CVE-2023-34648**