SourceCodester Lost and Found Information System cross site scripting

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Lost and Found Information System version 1.0. The flaw resides in the admin/ file, where the page parameter is not properly sanitized before being reflected in the response. An attacker can inject arbitrary HTML and JavaScript by crafting a malicious URL. The vulnerability is classified as problematic and has been publicly disclosed [1].

Exploitation

An attacker can exploit this vulnerability by crafting a URL such as /php-lfis/admin/?page=" and tricking a victim into visiting it. No authentication is required, and the attack can be launched remotely. The exploit does not require any special network position; the victim simply needs to click the link or be redirected to it [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement of the admin interface, or theft of sensitive information such as cookies or credentials. The impact is limited to the victim's browser session and does not directly compromise the server [1].

Mitigation

As of the publication date (2023-05-12), no official patch or updated version has been released by SourceCodester. Users should implement input validation and output encoding for the page parameter, or restrict access to the admin/ directory. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].