Description

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site_name/site_desc leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T11:17:39.180Z",
  "pubdate": "2026-09-07T11:17:39.180Z",
  "executiveSummary": "The Simple Traffic Offense System 1.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability located within the settings update functionality.\nThe vulnerability originates from improper neutralization of user-supplied input within the site_name and site_desc arguments in the save-settings.php file.\nSuccessful exploitation allows a remote, authenticated attacker to inject and execute arbitrary JavaScript code within the context of the victim's browser session.\nThis vulnerability poses a significant security risk, as it can be leveraged to hijack user sessions, perform unauthorized administrative actions, or deface the application interface.\nThe attack vector is remotely exploitable, and the existence of public exploit code increases the likelihood of exploitation by malicious actors.\nThe integrity and confidentiality of the application are compromised, as the attacker can manipulate the Document Object Model (DOM) to capture sensitive data or redirect users to malicious endpoints.",
  "technicalDetails": "The vulnerability resides in the save-settings.php file, which serves as the backend processing script for the Settings Update Endpoint within the Simple Traffic Offense System 1.0.\nThe root cause of this security flaw is an inadequate sanitization mechanism for the site_name and site_desc input parameters. The application fails to effectively encode or filter these inputs before persisting them to the database or rendering them back to the user interface.\nThe attack flow initiates when an attacker submits a crafted payload containing malicious JavaScript through the settings configuration interface. Upon submission, the save-settings.php script accepts this input without performing server-side validation or HTML entity encoding.\nThe malicious script is then stored in the backend database. When an administrator or another authorized user navigates to a page that renders the configuration settings, the application injects the stored payload directly into the HTML response.\nBecause the payload is reflected without proper escaping, the browser interprets the script as legitimate source code. This results in the execution of the attacker's script within the security context of the victim's origin. This is a classic example of Stored XSS, where the persistence of the payload ensures that the attack is triggered every time the affected component is loaded.\nPotential post-exploitation impact includes the theft of session cookies (session hijacking), unauthorized modification of system settings, or the deployment of a keylogger to capture credentials entered into the web interface. Because the vulnerability resides in the settings update component, it is highly probable that an attacker with administrative access or a compromised administrative account could perform this action to maintain persistent control over the system. The lack of output encoding ensures that any JavaScript placed within these fields will execute consistently in the victim's browser, bypassing simple client-side security measures."
}