vendor:
Employee Performance Evaluation System
by:
Ritesh Gohil
8.8
CVSS
HIGH
Persistent Cross Site Scripting
79
CWE
Product Name: Employee Performance Evaluation System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: 2.3:a:sourcecodester:employee_performance_evaluation_system:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10/Kali Linux
2020
Employee Performance Evaluation System 1.0 – ‘ Task and Description’ Persistent Cross Site Scripting
Employee Performance Evaluation System 1.0 is vulnerable to Persistent Cross Site Scripting. An attacker can exploit this vulnerability by logging in with Admin Credentials and clicking on 'Task' button. Then, clicking on Add New Task Button and adding the payload 'ritesh"><img src=x onerror=alert(document.domain)>' into the input field of Task and Description. When the attacker clicks on Save, the XSS payload is triggered.
Mitigation:
Input validation should be done to prevent malicious code from being injected into the application. Sanitization of user input should be done to prevent malicious code from being executed.
