Description

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-06T09:17:16.123Z",
  "pubdate": "2026-09-06T09:17:16.123Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in the Task Management System 1.0 within the User Profile Update component.\nThe vulnerability is located in the '/user/UpdateUserProfile.php' script and is triggered via the 'lname' parameter.\nThis flaw allows a remote attacker to inject malicious scripts into the web application, which are then executed within the context of the victim's browser session.\nSuccessful exploitation can lead to unauthorized access to sensitive user data, session hijacking, or the execution of unauthorized actions on behalf of the user.\nGiven that the exploit is publicly available, the risk of exploitation is significantly elevated for organizations utilizing this software version.\nAttackers can leverage this vulnerability without requiring complex setup, as it is accessible remotely and does not inherently require prior authentication depending on the implementation of the profile update endpoint.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) flaw localized within the 'lname' parameter of the '/user/UpdateUserProfile.php' file. The root cause is the failure of the application to properly sanitize or validate user-supplied input before reflecting it back to the browser in the server's HTTP response.\nThe attack flow begins when an attacker crafts a malicious URI containing a JavaScript payload within the 'lname' argument. When a targeted user or administrator visits this crafted link, the server processes the input and includes the unencoded payload in the HTML response. The browser, interpreting the injected script as legitimate content originating from the application, executes the code within the origin context of the Task Management System.\nThe vulnerable component, 'User Profile Update', processes the 'lname' input field. Because the application lacks sufficient output encoding mechanisms, characters such as '<', '>', and '\"' are rendered directly into the Document Object Model (DOM).\nExploitation is feasible via remote network access. Once the malicious payload executes, the attacker can perform a variety of post-exploitation activities, including but not limited to: stealing session cookies (allowing for session hijacking), redirecting users to malicious external sites, performing unauthorized actions as the logged-in user through asynchronous requests, or defacing the interface to harvest credentials.\nAs the exploit is publicly available, an attacker can automate the discovery of vulnerable instances. The impact is critical for any authenticated session, as the lack of proper input validation enables an attacker to bridge the gap between their external influence and the internal security context of the victim's session. The absence of adequate Content Security Policy (CSP) headers or context-aware output encoding significantly facilitates this attack vector."
}