hrshadhin/school-management-system

XSS Issue

leotrinh opened this issue · 2 comments

leotrinh commented

Describe the bug
As I checked the source I see someone added XSS script to input fields, please try to search this code
{{7*7]]"><img src=x onerror=prompt(document.cookie)>Maida LindOnesadsad

To Reproduce
Steps to reproduce the behavior:

  1. Log in to admin https://demo.cloudschoolbd.com/
  2. See alert message error

Screenshots
image

How to solve
You can check it here https://www.cloudways.com/blog/prevent-laravel-xss-exploits/

leotrinh commented

@hrshadhin please take a look, I've removed some of the scripts

hrshadhin commented

This is not the publicly used application. so we don't need xss protection. all the users who use this application are good actor.