Executive brief
Simple Traffic Offense System is a PHP-based application for managing traffic violations. An unauthenticated attacker can modify site configuration settings (such as site name and description) through a settings endpoint that lacks authentication checks, then inject malicious scripts that execute when administrators or users view pages displaying those settings. This could allow attackers to steal session cookies, impersonate users, or deface the application interface.
Technical details
The vulnerability combines missing authentication (CWE-306) and improper output encoding (CWE-79). The save-settings.php endpoint accepts POST requests to modify application-wide settings such as site_name and site_desc without verifying the caller's authentication status or authorization level. An attacker can send a crafted request with an XSS payload (e.g., <svg onload=alert(1)>) directly to this endpoint without a valid session. The malicious payload is stored in the application's configuration and later rendered into HTML in pages such as login.php and sidebar.php without proper output encoding, causing the JavaScript to execute in users' browsers when those pages load. The attack requires network access but no authentication, and affects all versions where the application is deployed.
Affected products
- SourceCodester Simple Traffic Offense System 1.0
Timeline
- 2026-07-27: disclosed
- 2026-09-07: advisory