CVE-2024-50969

Description

A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts or HTML via the search parameter.

Vulnerability Type

Cross Site Scripting (XSS)

Vendor of Product

Code-projects

Affected Product Code Base:

https://code-projects.org/jonnys-liquor-in-php-css-javascript-and-mysql-free-download/ - 1.0

Affected Component:

browse.php

Attack Vectors:

1. Set up the application locally
2. Navigate to the following URL in your web browser: http://localhost/jonnysLiquor-master/
3. In the search input field of the application, enter the following payload: ">
4. After submitting the input, the script executes in the browser, confirming the reflected XSS vulnerability.