Royal Event Management System Stored Cross-Site Scripting Scanner

The Royal Event Management System is a comprehensive platform designed for event planners and organizations to manage the entire lifecycle of events, from registration and ticketing to logistics and attendee engagement. It is widely used by both small-scale and large-scale event coordinators to automate tasks, handle vendor services, and provide analytics for performance assessment. The system streamlines complex arrangements, making it a critical tool for efficient event execution.

Stored Cross-Site Scripting (XSS) is a security vulnerability that arises when user-supplied data is stored on the server and later displayed in web pages without proper sanitization or encoding. In this case, the flaw occurs because the application fails to validate or escape input before persisting it, allowing attackers to inject malicious scripts that execute in the context of other users' browsers. This type of XSS is particularly dangerous as the payload remains active until removed.

The vulnerability specifically affects the companyprofile.php component, where user input fields such as company name, description, or contact details are processed. An attacker can submit a crafted payload containing JavaScript code through these fields, which is then stored in the database. When an administrator or other user views the company profile page, the malicious script executes automatically, bypassing client-side filters due to insufficient server-side validation.

If exploited, an attacker can steal session cookies, redirect users to phishing sites, deface the application, or perform actions on behalf of the victim, such as modifying event details or accessing sensitive data. This can lead to compromised user accounts, data breaches, and loss of trust in the event management system. The CVSS score of 7.2 reflects the high impact and ease of exploitation, especially if the application is publicly accessible.