Executive brief
Queue Management System, a software used to manage customer queues and service flows, is vulnerable to a security flaw in its user management interface. An authenticated user with administrative privileges can inject malicious scripts into the system's database through user profile fields. These scripts execute when other users view the user list, potentially leading to unauthorized actions or the theft of session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Queue Management System 4.0.0 due to improper input sanitization in the 'Add User' component. An authenticated attacker with administrative access can submit malicious JavaScript payloads within the 'First Name', 'Last Name', and 'Email' fields. These payloads are stored in the database and subsequently executed in the context of any user who navigates to the 'User List' page. This can be used to perform session hijacking or unauthorized administrative actions. As of the advisory date, the vulnerability is reported as unpatched.
Affected products
- CodeKernel.Net Queue Management System 4.0.0
Timeline
- 2020-12-21: disclosed: Exploit published on Exploit-DB
- 2026-05-16: advisory: NVD publication date