Executive brief
The code-projects Document Management System, a web application used for organizing and storing files, contains a security flaw that allows attackers to inject malicious scripts. By entering specially crafted text into the 'Company' field when uploading files, an attacker can steal sensitive session cookies from administrators. This could lead to unauthorized access to the system and the sensitive documents stored within it.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Document Management System 1.0 due to improper neutralization of user-supplied input in the 'Company' field during the file addition process. An attacker with low-level privileges can inject malicious JavaScript (e.g., <script>alert(document.cookie)</script>) into this field. When an administrator subsequently views or searches for the document, the script executes in their browser context. This can be leveraged to exfiltrate session cookies or perform actions on behalf of the administrator. The vulnerability is confirmed in version 1.0 and requires a logged-in user to submit the payload and an administrator to interact with the affected record.
Affected products
- code-projects Document Management System 1.0
Timeline
- 2025-09-16: disclosed
- 2025-09-16: advisory