| タイトル | itsourcecode Online Medicine Delivery System v1.0 Cross Site Scripting |
|---|
| 説明 | 1. Description
The order details page /index.php?q=orderdetails of Online Medicine Delivery System contains a reflected XSS vulnerability. The page receives the $_POST['location'] parameter and directly outputs it in 3 different HTML contexts without any HTML entity encoding (htmlspecialchars/htmlentities) processing:
(1) Echo inside HTML tags (lines 122-123): Directly output within a <span> tag in the Delivery Fee area
(2)Echo inside HTML attributes (line 119): Directly output within the value attribute of an <input> tag
(3)Echo after arithmetic operation (lines 128-130): In the Overall Price area, the location value participates in arithmetic calculation before being output
(4)The first echo point is the most direct XSS exploitation point, as the JavaScript code submitted by the attacker is directly parsed and executed by the browser.
2. Impact
(1)Cookie Theft/Session Hijacking: An attacker can steal the victim's Session ID via document.cookie, taking over their account
(2)Phishing Attacks: Can inject forged login forms to trick users into entering credentials |
|---|
| ソース | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md |
|---|
| ユーザー | xwniscoming2002 (UID 99874) |
|---|
| 送信 | 2026年07月16日 15:51 (2 月 ago) |
|---|
| モデレーション | 2026年09月03日 15:15 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 398415 [itsourcecode Online Medicine Delivery System 1.0 index.php?q=orderdetails location クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|