# OpenVidReview 1.0 Stored Cross-Site Scripting (XSS)

### Description

The application is vulnerable to Stored Cross-Site Scripting (XSS).

Administrators can insert malicious payloads into the review name field, which may allow the injection and execution of JavaScript code.
 
This issue is present in `admin.js` at [line 114](https://github.com/davidguva/OpenVidReview/blob/main/public/js/admin.js#L114). Other fields, such as review comments, might also be vulnerable due to similar issues with input handling.

Example Payload:
```json
{ "reviewName": "test5\" onfocus=\"alert(1)\" autofocus=", "password": "password" }
 ```

<br>

### Recommendations

Implement proper input validation and output encoding to mitigate XSS attacks. Ensure that all user inputs are sanitized before being rendered.

<br>

### References
[https://github.com/davidguva/OpenVidReview](https://github.com/davidguva/OpenVidReview)  
[https://github.com/davidguva/OpenVidReview/blob/main/views/admin.ejs](https://github.com/davidguva/OpenVidReview/blob/main/public/js/admin.js#L114)