black-scorp10/cve-2024-51430The Online Diagnostic Lab Management System has a security problem called Cross-Site Scripting (XSS) in the Borrower section.
Cross-Site Scripting (XSS)
Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component
Sourcecodester
The "Test Name" parameter on the diagnostic/add-test.php page is vulnerable.
The Online Diagnostic Lab Management System has a security problem called Cross-Site Scripting (XSS) in the Borrower section. This happens because the system doesn t clean user inputs properly, allowing harmful JavaScript code to be added. For example, if someone enters in the "Test Name" field, the system stores this code. When the "Manage Test" section is revisited, the code runs and shows an alert message. This could allow attackers to steal information or take unauthorized actions in the user's browser.
<script>alert(1)</script>