Summary

In SourceCodester QR Code Login System 1.0, the qr-code argument handled by add-user.php is written to the page without encoding. An attacker can supply script in that argument and have it execute in the browser of a user who loads the page. NVD scores it 6.1 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Details

The application does not neutralize the qr-code value before placing it in HTML. A crafted value is stored and then rendered as live markup, so the payload runs when the page is viewed.

Impact

The attacker controls JavaScript in the victim session, which can be used to read page contents or perform requests as the logged-in user.

Remediation

No fixed release exists for this 1.0 project. Encode the qr-code value on output and validate it on input.

References