hafizgemilang/cve-2025-56243Advisory detailing a reflected XSS vulnerability in PuneethReddyHC Event Management System v1.0, including impact analysis, reproduction steps, and mitigation recommendations.
Title: Reflected Cross-Site Scripting (XSS) via event_id parameter in register.php
Vendor / Repository: PuneethReddyHC / event-management
Affected Version: 1.0 (branch/tag master at the time of testing)
Reporter: Hafiz Pradana Gemilang
Disclosure Status: Vendor notified privately — exploit PoC withheld for user safety.
Status and timeline will be updated after coordination or patch release.
A Reflected Cross-Site Scripting (XSS) vulnerability was identified in register.php, where the event_id GET parameter is not properly sanitized before being reflected into the page output.
A remote attacker can craft a malicious URL that executes arbitrary JavaScript in the victim’s browser once they visit or are redirected to the link.
⚠️ This advisory intentionally omits an active exploit payload.
The full proof-of-concept has been provided privately to the vendor for patch development.
/register.php?event_id=<value>
Example (local testing):
http://<host>/event-management-master/register.php?event_id=1
Successful exploitation allows arbitrary JavaScript execution in the context of the affected domain.
Potential consequences:
HttpOnly)Estimated CVSS v3.1: 6.1 (Medium) — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
event_id parameter.Full payload and proof-of-concept have been shared privately with the vendor.
If you are the maintainer and require access, please contact the reporter (see below).
Apply server-side validation and output encoding to prevent reflected XSS.
Input Validation
If event_id is numeric, enforce numeric validation:
$event_id = filter_input(INPUT_GET, 'event_id', FILTER_VALIDATE_INT);
if ($event_id === false) {
// handle invalid input
}
Output Encoding
Escape user-supplied data before printing to HTML:
echo htmlspecialchars($event_id, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
Use Secure Frameworks or Templates
Prefer frameworks that automatically perform context-aware escaping.
Secure Cookies
Set HttpOnly, Secure, and SameSite flags on session cookies.
Content Security Policy (CSP)
Apply a strict CSP and avoid using unsafe-inline.
Code Review & Audit
Check all other reflected parameters throughout the application.
// Validate numeric input
$event_id = filter_input(INPUT_GET, 'event_id', FILTER_VALIDATE_INT);
if ($event_id === false || $event_id === null) {
$event_id = 0; // or display an error / redirect
}
// Safe output
?>
<span id="event-id"><?= htmlspecialchars($event_id, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') ?></span>
<?php
htmlspecialchars() Docs: https://www.php.net/manual/en/function.htmlspecialchars.phpReported by: Hafiz Pradana Gemilang
This advisory omits detailed exploit code to protect users of the affected software.
Full technical details are available to the vendor or authorized coordinators upon request under responsible disclosure terms.