Summary

SourceCodester Wedding Guest e-Book 1.0 takes the name argument sent to /endpoint/add-guest.php and writes it back to the page without encoding it. An attacker can put HTML or JavaScript in that field and have it run when the guestbook is viewed. NVD scores it 6.1 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Details

The name value is rendered into the page with no output encoding. Submitting markup in that argument stores a payload that fires the next time someone loads the affected page. No account is needed to submit the entry, but a victim has to view it for the script to execute.

Impact

Script runs in the browser of anyone who views the injected entry. That access is enough to hijack the viewer session or take actions as them inside the app.

Remediation

There is no fixed release for this 1.0 project. Encode the name value on output and reject markup on input.

References