Executive brief
code-projects Record Management System is a PHP-based application for managing transaction records. A stored cross-site scripting (XSS) vulnerability in the transaction registration form allows unauthenticated users to inject malicious JavaScript that is executed in the browsers of all users viewing the transaction list, potentially leading to session theft, credential harvesting, or unauthorized actions.
Technical details
The vulnerability is a stored XSS flaw in the transaction registration endpoint main/reg.php. The application accepts user input via the `desc` parameter and directly inserts it into the database without sanitization or output encoding. When the transaction list is displayed by main/index.php, the stored payload is echoed directly into an HTML `<td>` element without HTML escaping. The injection requires no authentication—the application performs no session validation on any main/ routes. An attacker can POST a payload like `<sCrIpT>alert(9999)</sCrIpT>` to /main/reg.php, and the script will execute in the browser of every user who opens the transaction list page. No patch status or mitigation guidance is currently available in the advisory.
Affected products
- code-projects Record Management System 1.0
Timeline
- 2026-09-15: disclosed