Key Information Affected Product Product Name: Apartment Visitors Management System Affected File: /manage-pass.php Vulnerable Parameter: visitorname Vulnerability Type: Stored Cross-Site Scripting (XSS) Severity: High Description A stored Cross-Site Scripting (XSS) vulnerability has been discovered in the Apartment Visitors Management System. This vulnerability arises from insufficient serialization and output encoding of the field, which is submitted via a POST request to . User-supplied input is saved and later rendered directly as HTML content in without any escaping or filtering. This allows attackers to inject malicious JavaScript, which will execute in the browser of any user visiting the page—including administrators. Technical Details Root Cause The parameter is not validated or encoded before rendering. The content is injected into the HTML body context, enabling execution of event handler attributes such as . No Content Security Policy (CSP) is in place to restrict execution behavior. Impact Attackers can: - Execute arbitrary JavaScript in victims’ browsers. - Steal cookies or session tokens. - Perform CSRF-like attacks via session hijacking. - Gain elevated privileges if administrators view the injected content. - Expose sensitive data or redirect users to malicious sites. Vulnerability Location & Parameter File: /manage-pass.php Injection Point: visitorname (via POST request to ) Receiver: HTML output (no escaping) Proof of Concept (PoC) Detailed HTTP request examples and response screenshots are provided, demonstrating how to exploit the vulnerability. Recommended Remediation 1. Output Encoding (Server-side fix - mandatory) 2. Input Validation 3. Implement Content Security Policy (CSP) 4. Use Sanitizers