Key Information Affected Product Product Name: Apartment Visitors Management System Affected File: /awards-reports.php Injection Point: /awards/visitors-form.php Vulnerable Parameter: xVisitor Vulnerability Type: Stored Cross-Site Scripting (XSS) Severity: High Discoverer: HieuGITLAB Tested Version: V1.0 Description A stored Cross-Site Scripting (XSS) vulnerability was discovered due to improper input sanitization and inadequate output encoding. User-supplied input submitted via POST request in the field is saved and directly rendered as HTML content in without any escaping or filtering. Technical Details Root Cause The parameter is not sanitized or encoded before rendering. The content is injected into the HTML body context, allowing execution of event-handling attributes such as . No Content Security Policy (CSP) is in place to restrict execution behavior. Impact Attackers can: - Execute arbitrary JavaScript code in visitors’ browsers. - Steal cookies or session tokens. - Perform CSRF-like attacks via session hijacking. - Gain elevated privileges if administrators view the injected content. - Expose sensitive data or redirect users to malicious sites. Vulnerability Location & Parameter File: /awards-reports.php Injection Point: xVisitor (via POST request to /awards/visitors-form.php) Issue: HTML Output (no escaping) Proof of Concept (PoC) Includes HTTP request examples and screenshots. Recommended Remediation 1. Output Encoding (Server-side fix - mandatory) 2. Input Validation 3. Implement Content Security Policy (CSP) 4. Use a sanitizer