CVE-2021-41434: Stored Cross-Site Scripting Vulnerability in Expense Management System by EGavilan Media

Vulnerability Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application by EGavilan Media that allows for arbitrary execution of JavaScript commands.

Stored XSS vulnerabilities enable attackers to store malicious scripts in a target application. These scripts are then served to users who view the stored data, potentially leading to session hijacking, credential theft, or redirection to malicious sites.

CVSS v3.1 Metrics

Weakness Enumeration

Proof of Concept (PoC)

Steps to Reproduce

1. Download, install, and run the Expense Management System application (version 1.0).
2. Navigate to: http://localhost/index.php
3. Click on Add Expense and fill out the form as follows:
   • Description: <script>alert(document.cookie);</script>
   • Amount: any numeric value
   • Date: any valid date

4. Press the Save button.
5. Navigate to the page displaying the newly added expense.
6. The JavaScript payload will execute from the description field.

Suggested Mitigations

• Properly encode all dynamic content before rendering in HTML.
• Sanitize user inputs server-side using am HTML sanitization library.
• Implement Content Security Policy (CSP) headers to mitigate script injection.

References

• https://github.com/EGavilan-Media/Expense-Management-System
• https://www.cve.org/CVERecord?id=CVE-2021-41434
• https://nvd.nist.gov/vuln/detail/CVE-2021-41434
• https://portswigger.net/web-security/cross-site-scripting/stored
• https://owasp.org/www-community/attacks/xss/