CVE-2025-0844 | Library-Card-System | Stored Cross Site Scripting In signup.php |

Hi All, 

I am Maloy Roy Orko.

Recently in one of my pentest research, I found a Library-Card-System application By Needyamin which is an open source Library-Card-System to print a library card with student information using PHP, MYSQL, JAVASCRIPT.

It is based on the scripting languages of PHP. Library-Card-System is a Library-Card-System using PHP, MYSQL, JAVASCRIPT

Curious to explore its functionalities, I downloaded and set it up in my local system. 

After fiddling with the source code, I found that it did not have any kind of XSS Protection in signup.php file.

It can lead into:

1. Malware Distribution
2. Admin & User Account Takeover
3. Data Breach
4. Users Into Risk
5. Reputation Damage

The Main Thing Is,If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this.

• Title of the Vulnerability: 

• Library-Card-System | Stored Cross Site Scripting In signup.php | Found By Maloy Roy Orko

• Vulnerability Class: Stored Cross Site Scripting 

• Product Name: Library-Card-System

• Vendor: https://github.com/needyamin/

• Vulnerable Product Link: https://github.com/needyamin/Library-Card-System/

• Technical Details & Description: The application source code is coded in a way which allows Stored Cross Site Scripting .It can lead into:

1. Malware Distribution
2. Data Breach
3. Denial of Service (DoS)
4. Web Shell Installation
5. Reputation Damage

• Product & Service Introduction: Library-Card-System

• Observation & Exploitation: 

Here,The Vulnerable File Is: /signup.php/

Here,The Impact Will Be Shown In:

• /admindashboard.php/ 
• 
  
• /card.php?id=valid id/

Lets Exploit 🌠🗝️🔐:

1. First,Go To signup.php
2. Example: 192.168.0.100:8080/libb/signup.php
3. Now,Use XSS Payloads To Signup In The Sign Up Fields.
4. Here,I Am Inputing XSS PAYLOADS IN First Name & Book Name Field.
5. The Payloads Are Inputted Like This:
6. 
   See The Image 

• First Name: Ovro<script>alert("XSS Found By Maloy");</script>
• Book Name: Book<script>alert("xss");</script>Nil

Thus,We will input xss payloads and it will be stored.

Then,where they will be executed? 

Which Advantages,We will get?

• We will be able to Takeover Admin As XSS Payloads Direct Gives Impact On /admindashboard.php
• 
• 
  
We will be able to execute malicious JavaScript codes into visitors browser via /card.php
• 
  
  
  
  
  
  
  

Conclusion :- 

The main aim of this article is to show that if any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too. But I also hope that it helps to give you ideas of how combi

ning attacks can make them much more potent.