Description

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-08-07T15:17:00.120Z",
  "pubdate": "2026-08-07T15:17:00.120Z",
  "executiveSummary": "A security vulnerability has been identified in the PHPGurukul Company Visitor Management System 1.0, specifically within an unknown processing routine of the file /manage-newvisitors.php.\nThe vulnerability is classified as a Cross-Site Scripting (XSS) flaw, which arises due to the improper sanitization and neutralization of user-supplied input submitted via the fullname argument.\nSuccessful exploitation of this vulnerability allows remote attackers to inject malicious scripts, typically in the form of JavaScript, into web pages rendered to other users or administrators.\nThe impact of this Cross-Site Scripting condition includes potential session hijacking, credential theft, redirection to malicious infrastructure, and unauthorized actions performed within the context of the victim's browser session.\nThe attack vector is network-based, enabling remote exploitation without requiring prior physical access to the target system.\nPublic disclosure of the exploit increases the risk of active exploitation by malicious actors scanning for unpatched installations of Company Visitor Management System 1.0.\nOrganizations deploying this software face significant risk if input validation and output encoding controls are absent or improperly implemented on the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the application logic associated with /manage-newvisitors.php in PHPGurukul Company Visitor Management System 1.0.\nThe root cause of the vulnerability is the lack of proper input sanitization and contextual output encoding for data supplied through the fullname HTTP request parameter.\nWhen a user or administrator accesses the affected functionality in /manage-newvisitors.php, the application dynamically generates Hypertext Markup Language (HTML) content containing the raw, unfiltered string provided in the fullname parameter.\nBecause the input is reflected directly into the Document Object Model (DOM) or response body without adequate escaping, any malicious payload supplied by an attacker is executed by the victim's browser.\nThe attack flow begins when an attacker crafts a malicious Uniform Resource Locator (URL) or submits an HTTP request containing an embedded script payload (such as <script>alert(document.cookie)</script>) via the fullname argument.\nIf the payload is stored or reflected during the processing within /manage-newvisitors.php, subsequent viewers of the generated management interface execute the arbitrary script.\nThis vulnerability involves remote network exposure, allowing external threat actors to initiate the attack vector over HTTP or HTTPS depending on the server configuration.\nAuthentication and privilege requirements depend on the access control enforcement of /manage-newvisitors.php, but successful execution typically impacts administrative or privileged users who review visitor logs.\nPost-exploitation impact includes the execution of arbitrary JavaScript within the security context of the victim session, potentially leading to session token theft, DOM manipulation, keylogging, or unauthorized administrative actions performed against the Company Visitor Management System 1.0."
}