Overview
A vulnerability in Phproject 1.8.0–1.8.2 allows any authenticated user to inject HTML/JavaScript into the Planned Hours field when creating or editing a project. The input is stored in the SQLite database and reflected unsanitized in the HTML of the issue page, leading to persistent execution of malicious scripts in other users’ browsers.
Affected Versions
- Phproject 1.8.0 – 1.8.2 (SQLite only)
Patched Versions
- Phproject ≥ 1.8.3
Technical Details
The vulnerability occurs because the server includes the planned_hours field in the HTML response without proper encoding or sanitization. An attacker can submit a payload such as:
<script>alert(1)</script>This input is reflected in the issue page HTML, which the browser interprets and executes, causing a Stored XSS condition.
PoC
1. Log in as any authenticated user.
2. Navigate to /issues/new/ to create a new project.
3. In the "Planned Hours" field, enter: <script>alert(document.domain)</script>
4. Submit the form.
5. When viewing the project issue page, the alert executes, demonstrating Stored XSS.Impact
- Authenticated users viewing the affected project page will execute the malicious payload.
- Allows persistent Stored XSS, which can be used for session theft, UI redressing, or phishing attacks.
- Only Phproject installations using SQLite databases are affected.
Solution
- Upgrade to Phproject 1.8.3 - https://github.com/Alanaktion/phproject/releases/tag/v1.8.3
Timeline
- 2025-08-20 – Vulnerability reported
- 2025-08-21 – Patch released in version 1.8.3
- 2025-08-22 – CVE assigned (CVE-2025-57768)
- 2025-08-22 – Advisory published
References
- Phproject Security Advisory - https://github.com/Alanaktion/phproject/security/advisories/GHSA-mhhg-qx37-g369