Attack Chain

1. Attacker authenticates to the application with privileges sufficient to add account types.
2. Attacker navigates to the "Add Acc Type" functionality.
3. Attacker submits a malicious payload containing JavaScript within the 'name' parameter field.
4. The application saves the unsanitized payload into the backend database.
5. An administrator or user accesses the "Manage Acc Types" administrative menu.
6. The application renders the stored payload within the admin interface, triggering JavaScript execution in the victim's browser session.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session. Documented potential impacts include session hijacking, credential theft, and unauthorized account takeover.

Recommendation

• Identify and inventory all instances of Codeastro Internet Banking System 2.0.0 within the environment.
• Implement strict HTML entity encoding for all user-supplied input fields, specifically the 'name' parameter in 'pages_add_acc_type.php'.
• Deploy a robust Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts.
• Until a patch is provided, restrict access to administrative functions and audit logs for anomalous changes to account type definitions.