Description

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-06T22:17:20.673Z",
  "pubdate": "2026-09-06T22:17:20.673Z",
  "executiveSummary": "A reflected Cross-Site Scripting (XSS) vulnerability exists within the profile.php component of Projectwolds Online Attendance System 1.0.\nThe vulnerability arises due to the improper neutralization of user-supplied input provided through the email argument, which is processed and reflected back to the client-side browser without adequate sanitization or output encoding.\nSuccessful exploitation allows a remote, unauthenticated or authenticated attacker to execute arbitrary JavaScript within the context of the victim's session.\nThe impact includes potential unauthorized access to session cookies, sensitive information disclosure, session hijacking, and the potential for defacement or redirection of users to malicious third-party domains.\nGiven the public availability of the exploit code, the risk is elevated, necessitating immediate attention to input validation and output handling practices within the application.\nThe flaw affects the stability and confidentiality of user data within the affected system version.",
  "technicalDetails": "The vulnerability is a classic case of reflected Cross-Site Scripting (XSS) located in the profile.php file of the Projectwolds Online Attendance System 1.0.\nThe root cause is the lack of server-side sanitization or contextual output encoding for the email parameter.\nWhen a user provides input via the email argument, the application reflects this input directly into the HTML document returned to the client browser.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious URI containing a JavaScript payload within the email parameter. 2) The attacker lures an unsuspecting victim into clicking the link or submits the payload via an automated vector. 3) The server-side code in profile.php receives the tainted request and includes the malicious input into the response body.\nBecause the web browser interprets the reflected payload as legitimate script content, it executes the injected JavaScript code within the context of the current session's origin.\nThe vulnerability is accessible remotely over the network, allowing attackers to target any user accessing the profile.php page.\nPayload behavior typically involves targeting document.cookie to exfiltrate session identifiers or manipulating the Document Object Model (DOM) to capture credentials through fake form overlays.\nPost-exploitation, the attacker can hijack the user's session, perform actions on their behalf, or gain unauthorized access to the application's sensitive data stores.\nNo complex authentication or privilege requirements are stated, as the reflection happens during the page rendering process which may be public or accessible by any authenticated user profile.\nTechnical failure occurs because the application fails to utilize character entity encoding (converting < to &lt;, etc.) before the echo process in PHP.\nThis allows the browser to interpret the attacker-supplied string as an executable <script> block rather than plain text, bypassing intended security boundaries."
}