CodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scripting

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in CodeAstro Online Railway Reservation System version 1.0. The affected pages are /admin/admin-add-employee.php and /admin/admin-update-employee.php, where the parameters emp_fname, emp_lname, emp_nat_idno, and emp_addr are echoed directly into HTML without proper sanitization or validation. This allows an attacker to inject arbitrary JavaScript code that is stored and executed when the page is viewed [1].

Exploitation

An attacker must be authenticated as an administrator to access the employee management pages. The reference provides default credentials (admin@mail.com / codeastro.com) [1]. Once logged in, the attacker can navigate to either the add or update employee page and inject a malicious payload (e.g., ``) into any of the four vulnerable fields. The payload is stored in the database and executed in the browser of any admin who subsequently views the affected page [1].

Impact

Successful exploitation results in stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of the admin panel. This can lead to session cookie theft, unauthorized actions performed on behalf of the admin, or defacement of the admin interface. The impact is confined to the admin area but could compromise the entire application if admin credentials are stolen [1].

Mitigation

As of the publication date (2024-08-15), no official patch has been released by the vendor. The application may be end-of-life or unsupported. As a workaround, implement strict input validation and output encoding for all employee profile fields. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog [1].