> Stored Cross-Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into a web application's database. The malicious script is saved on the server and later rendered in other users' browsers. When other users access the affected page, the stored script executes, potentially stealing data or compromising user security.
> Multiple parameters within `Add Tracker` and `Update Tracker` requests are vulnerable to Stored Cross-Site Scripting. The application failed to sanitize user input while storing it to the database and reflecting back on the page.
## Proof of Concept:
The following payload `<script>alert('STORED_XSS')</script>` can be used in order to exploit the vulnerability.
Below is an example of a request demonstrating how a malicious payload can be stored within the `day` value:
When using this tracking system, it is essential to update the application code to ensure user input sanitization and proper restrictions for special characters.