إرسال #881484: SourceCodester Stock Management System v1.0 V1.0 XSS

- A Stored XSS vulnerability was found in the `/php_action/printOrder.php` file of the "Stock Management System" project. The vulnerability stems from the `clientName` and `clientContact` fields submitted via `php_action/createOrder.php`, which are stored in the database without any sanitization. When `printOrder.php` retrieves and outputs these values directly into raw HTML without `htmlspecialchars()` or any output encoding, malicious script code injected during order creation is executed in the victim''s browser when the print order page is accessed.
- Attackers can exploit this Stored XSS vulnerability to steal cookies, session tokens, or other sensitive information of any user who views the print order page. The attacker can perform actions on behalf of the victim, deface web pages, redirect users to malicious websites, and even gain control of the victim''s browser, posing a serious threat to user privacy and system security.
- During the security review of "Stock Management System", I discovered a critical Stored XSS vulnerability in the "/php_action/printOrder.php" file. This vulnerability stems from insufficient input validation when creating orders and lack of output encoding when printing orders. Attackers can inject malicious script code through the client name or contact fields when creating an order, which is then stored in the database and executed whenever an administrator views the print order page.

• المصدر: ⚠️ https://github.com/i-QvQ-i/first-OvO/issues/12
• المستخدم: i-OvO-i (UID 97659)
• ارسال: 06/07/2026 09:06 PM (2 أشهر منذ)
• الاعتدال: 22/08/2026 12:12 PM (2 months later)
• الحالة: تمت الموافقة
• إدخال VulDB: 394299 [SourceCodester Stock Management System 1.0 printOrder.php clientName/clientContact البرمجة عبر المواقع]
• النقاط: 20