关键漏洞信息 Description CVE ID: CVE-2025-70890 Vulnerability Type: Stored Cross-Site Scripting (XSS) Description: An authenticated attacker can exploit this vulnerability by submitting crafted input containing malicious JavaScript code via the endpoint during the user creation process. The application fails to properly sanitize user-supplied input, allowing persistent storage and execution of malicious JavaScript code in the victim's browser. Affected Product Product: Cyber Cafe Management System Vendor: PHPGurukul Version: v1.0 Affected Component File: add-users.php Parameter: username Request Method: POST Attack Vector An authenticated attacker can exploit this vulnerability by submitting crafted input containing malicious JavaScript code via the endpoint during the user creation process. Impact Execution of arbitrary JavaScript code Information disclosure Potential session hijacking Unauthorized actions performed in the context of authenticated users Proof of Concept The issue was validated by injecting a JavaScript payload into the parameter during user creation. When the list of users is accessed through the endpoint, the stored payload is rendered and executed automatically in the victim's browser. Mitigation Validate and sanitize all user-supplied input on the server side Apply proper output encoding when rendering dynamic content Implement a strict Content Security Policy (CSP) Use secure input handling mechanisms and frameworks Discoverer Efe Kaan AKKAR