Executive brief
Projectworlds Online Attendance System is a PHP-based application used to track student and employee attendance. A stored cross-site scripting vulnerability in the user profile email field allows attackers to inject malicious JavaScript that executes whenever the profile is viewed, potentially leading to session hijacking and account takeover due to lack of HttpOnly flag on session cookies.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw in the profile management functionality (profile.php, update_profile.php, process_signup.php). The root cause is an overly permissive email validation regex in the verify() helper that only blocks whitespace characters but allows HTML metacharacters (<, >, ", '), permitting attackers to inject arbitrary HTML and JavaScript payloads during registration or profile update. The injected payload is stored in the database and later reflected unescaped within an HTML attribute on the profile page, breaking out of attribute context and executing in the victim's browser. Attack vector is network-based with no special authentication required beyond account creation. Session hijacking is possible because the PHPSESSID cookie lacks the HttpOnly flag, allowing injected scripts to read and exfiltrate session tokens. No patch information is currently available; the advisory indicates ongoing coordination with maintainers.
Affected products
- Projectworlds Online Attendance System 1.0
Timeline
- 2026-09-06: disclosed: Published to NVD
- 2026-09-06: other: Exploit released publicly