| タイトル | Amir Sanni Mini Inventory and Sales Management System 1.0 Cross Site Scripting (persistent) |
|---|
| 説明 | The Mini Inventory and Sales Management System by Amir Sanni is
vulnerable to stored Cross-Site Scripting (XSS) via the Item Name
parameter in the Items management module.
Root Cause:
1. No input sanitization - The itemName field in Items.php only
validates length and uniqueness, with no strip_tags or XSS
filtering (global_xss_filtering is FALSE in config.php).
2. No output encoding - itemslisttable.php outputs the item name
directly into HTML using bare <?= without htmlspecialchars(),
allowing the raw payload to be rendered in browsers.
Proof of Concept:
1. Log in as [email protected] / demopass
2. Navigate to Items > Add Item
3. Enter <img src=x onerror=alert(1)> as the Item Name
4. Save - the payload executes immediately on the items list page
and also triggers in transaction listings, receipts, and event logs.
Impact:
Session hijacking, account takeover via credential harvesting,
privilege escalation through CSRF-like actions on behalf of
victims, and data exfiltration - all achievable with a single
injected payload that persists in the database.
This vulnerability is distinct from CVE-2024-42550, which affected
the email template Title field. The code paths and affected files
are entirely different.
Affected files:
- application/controllers/Items.php (input)
- application/views/items/itemslisttable.php (output)
- application/views/transactions/transtable.php (output)
- application/views/transactions/transreceipt.php (output) |
|---|
| ユーザー | stephen30 (UID 100432) |
|---|
| 送信 | 2026年08月07日 09:15 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 11:14 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410856 [amirsanni mini-inventory-and-sales-management-system 迄 81bf0b55f5933f3b0dbb1583204a612e06605b95 Items Management Items.php itemName クロスサイトスクリプティング] |
|---|
| ポイント | 17 |
|---|