CVE-2025-50363_BXSS_CVE

Project Name & Repo URL: Maid Hiring Management System using PHP and MySQL

Vulnerability Type: Privilege Escalation via Blind XSS

**Affected Version(s):**v1.0

💣Vulnerability Description: A Blind Cross-Site Scripting (XSS) vulnerability was discovered in the Maid Hiring Management System, which allows a regular user (such as a maid or employer) to escalate their privileges and potentially take control of an administrative account.

👩‍💻Impact: Full admin account takeover, access to sensitive data, and system manipulation.

🛜Proof-of-Concept (PoC)

1. There was mhms/maid-hiring.php, where a user can apply for job post.
2. Fill out the form with a Blind XSS payload in Name Field and Submit the Form.
3. When the admin view the application, the Blind XSS payload will get trigged.
4. View the Response of the Blind XSS Payload, which contains admin Session-Cookie.
5. Use the admin cookie to escalate the privilege.

Recommendation: Sanitize input, apply output encoding, and implement CSP.