Stored XSS Vulnerability in Phpgurukul Online Birth Certificate System

A stored cross-site scripting (XSS) vulnerability exists in the Phpgurukul Online Birth Certificate System version 1.0. The vulnerability resides within the 'profile_name' parameter of the '/user/certificate-form.php' script. An attacker with authenticated access can inject malicious JavaScript payloads into the profile name field. When this data is rendered by the application, the payload executes within the victim's browser session. This vulnerability poses a risk to data integrity and session security, as an attacker could potentially steal session tokens or manipulate the victim's view of the application. The vulnerability is identified as CVE-2024-57175 and carries a CVSS score of 5.4. Public proof-of-concept code is available, increasing the likelihood of exploitation by malicious actors targeting this specific application.

Attack Chain

1. Attacker gains valid credentials for a standard user account in the Phpgurukul Online Birth Certificate System.
2. Attacker authenticates to the application using these credentials.
3. Attacker navigates to the 'certificate-form.php' endpoint within the user portal.
4. Attacker intercepts or crafts a POST request to update the profile information.
5. Attacker injects a malicious JavaScript payload (e.g., <script>alert(1)</script>) into the 'profile_name' parameter.
6. The application stores the malicious payload in the underlying database without proper sanitization.
7. A victim user (or the attacker) accesses the page where the profile name is rendered.
8. The victim's browser renders the stored payload, executing the JavaScript in the user's session context.

Impact

Successful exploitation allows for arbitrary client-side code execution in the context of the user's browser. This can lead to unauthorized actions performed on behalf of the user, theft of session cookies, or the exfiltration of sensitive information displayed on the page.

Recommendation

1. Implement strict input validation and sanitization for all user-supplied data, specifically for the 'profile_name' field in the 'certificate-form.php' script.
2. Employ context-aware output encoding when rendering user-generated content in the browser to neutralize potential XSS payloads.
3. Enforce the use of a Content Security Policy (CSP) to restrict the sources from which scripts can be executed.
4. Ensure all authenticated sessions are protected by modern browser security headers to mitigate session hijacking risks.