Executive brief
code-projects Task Management System is an open-source PHP application for managing tasks and user profiles. A stored cross-site scripting (XSS) vulnerability in the user profile update functionality allows authenticated users to inject malicious JavaScript code via the last name field, which is executed in the browsers of other users who view the compromised profile. An attacker can exploit this to steal session cookies, perform unauthorized actions on behalf of other users, or redirect them to malicious websites.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the /user/UpdateUserProfile.php endpoint of the Task Management System version 1.0. The vulnerable component fails to properly sanitize or encode user input in the "lname" (last name) parameter before storing it in the database and displaying it in user profiles. The attack requires authentication but is executed over the network against other users who view the attacker's profile. An attacker can inject arbitrary JavaScript code that will execute in the context of the victim's browser session. No patch information is currently available; mitigation requires applying contextual output encoding, input validation, and implementing Content Security Policy headers.
Affected products
- code-projects Task Management System 1.0
Timeline
- 2026-09-06: disclosed: Vulnerability publicly disclosed; exploit proof-of-concept published on GitHub