Stored HTML Injection

Dear Ladies and Gentlemen,

First of all thank you for your time and effort reading my Report.

While doing the Penetration Test i was able to identify a stored XSS in the Username.

When an admin or another Users try to set up a new account and set his name to <script>alert(‘1’)</script> the Javascript will run and will be stored for admin and all other Users.

The Process of the Vulnerability:

1. Login
2. Go to https://roy.demo.phpmyfaq.de/admin/?action=user&user_action=listallusers
3. Create a new User or change his username with <script>alert(‘1’)</script>
4. Refresh the Page from any Account admin or normal User the Code will run
   Example for the HTML Code:
   <script>alert(‘1’)</script>

Mitigation:
Please do not allow Javascript Code to run and never trust User-Input.

At the End I want to thank you for your time and effort and hope hearing from you soon.

Best regards
Ahmed Hassan