| शीर्षक | SourceCodester Web-based Pharmacy Product Management System 1.0 Cross Site Scripting |
|---|
| विवरण | A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Web-based Pharmacy Product Management System version 1.0. The vulnerability affects the profile update functionality in edit-profile.php, specifically the "fullname" parameter.
The application does not properly sanitize or encode user-supplied input before storing it in the database. An authenticated attacker can inject malicious JavaScript into the fullname field. The payload is stored persistently and rendered within the global application layout (e.g., header or navigation area).
As a result, the injected script executes automatically on every page load across the application after profile modification. Successful exploitation allows execution of arbitrary JavaScript in the context of authenticated users, potentially leading to session hijacking, privilege escalation, and unauthorized actions. |
|---|
| स्रोत | ⚠️ https://gist.github.com/Denilxavier/6b21cb788f7f545179286f6c44989448 |
|---|
| उपयोगकर्ता | Denil Xavier (UID 95932) |
|---|
| सबमिशन | 26/02/2026 04:39 PM (8 महीनों पहले) |
|---|
| संयम | 07/03/2026 09:51 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 349744 [SourceCodester Web-based Pharmacy Product Management System 1.0 edit-profile.php fullname क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|