Executive brief
The code-projects Client Details System, a web application used for managing customer information, contains a security flaw that allows attackers to inject malicious scripts. By entering specially crafted text into the username field when adding a new customer, an attacker can execute code in the browser of an administrator who views that record. This could lead to the theft of administrative login sessions or unauthorized actions performed on behalf of the administrator.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Client Details System 1.0. The application fails to properly sanitize or neutralize user-supplied input in the 'username' field during the customer creation process. An unauthenticated or low-privileged attacker can submit a payload containing malicious JavaScript. When an administrative user later views the customer details, the script executes in their browser context. This can be leveraged to steal session cookies (document.cookie) or perform unauthorized administrative actions. The vulnerability is tracked as CVE-2025-60302.
Affected products
- code-projects Client Details System 1.0
Timeline
- 2025-10-09: disclosed
- 2025-10-09: advisory