Client » PQS_Japan

The About Us → Parts Inquiry form lacks proper validation, leading to serious security vulnerabilities such as DDoS attacks, XSS, HTML injection, and malicious PHP file uploads. Additionally, injected input payloads are rendered directly in the email output, increasing security risk.

Module / Page
About Us

Module Section
Parts Inquiry Form

Screen Size
All Devices

Tested By
Aman Bhuiyan

Steps to Reproduce¶

1. Navigate to About Us → Parts Inquiry page.
2. Enter malicious payloads (HTML/JS) in input fields.
3. Upload unsupported or malicious file types (e.g., PHP files).
4. Submit the form.
5. Observe the email output and system behavior.

Expected Result

The form should have proper input validation, file type restrictions, and file size limitations.
Malicious payloads should be sanitized and never rendered in email outputs.

Actual Result

The form accepts malicious inputs and unsupported files, and injected payloads are rendered in the email output.

Attachments
Proof of Concept

Types of Issue
Security / Validation Issue

Root Cause:

Impacted Area: