Executive brief
The Human Resource Integrated System is a web application used for managing employee records. A security flaw allows a low-privileged user to inject malicious scripts into the 'Child Name' field within the family information section. If an administrator views this information, the script executes in their browser, potentially allowing the attacker to steal administrative session cookies and gain unauthorized access to the entire HR system.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Human Resource Integrated System 1.0 due to improper neutralization of user-supplied input in the 'Childs Name' field within the 'Add Child Information' module. An authenticated attacker with low-level privileges can submit a malicious JavaScript payload that is stored in the application's database. When an administrative user views the affected record, the payload executes in the context of their session. This can lead to session hijacking via cookie theft (as demonstrated in the PoC) or unauthorized actions performed on behalf of the administrator. The vulnerability is tracked as CWE-79.
Affected products
- code-projects Human Resource Integrated System 1.0
Timeline
- 2025-09-16: disclosed
- 2025-09-16: advisory