Summary

SourceCodester Testimonial Page Manager 1.0 passes the name, description, and testimony POST fields in add-testimonial.php straight into the page output. Any of them can carry script that runs in a viewer browser. NVD scores it 6.1 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Details

The POST request handler stores the submitted fields and later renders them as HTML without encoding. A payload placed in one of those fields executes when the testimonial is displayed.

Impact

An attacker gets JavaScript execution in the context of whoever views the testimonial, which can lead to session hijacking or actions taken as that user.

Remediation

No fixed release exists for this 1.0 project. Encode these fields on output and filter markup on input.

References