| タイトル | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| 説明 | A Cross-Site Scripting (XSS) vulnerability (CWE-79) was found in SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database v1.0. The issue affects the /drug_recommender/Admin/add_symptom endpoint through the txtname POST parameter. User input is reflected back into the HTML response without proper output encoding, allowing an authenticated attacker to inject and execute JavaScript in the administrator's browser. Testing also showed that the PHPSESSID session cookie could be accessed through JavaScript because the cookie does not have the HttpOnly flag, which could potentially lead to session hijacking and unauthorized access to administrator functionality and sensitive application data.
Product Website:
https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html
RESEARCHERS:
Researcher 1: Karan Parelkar
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher 2: Anubhav Verma
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher 3: Parth Desai
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/ |
|---|
| ソース | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md |
|---|
| ユーザー | anubhav106 (UID 98769) |
|---|
| 送信 | 2026年08月24日 15:53 (27 日 ago) |
|---|
| モデレーション | 2026年09月19日 17:22 (26 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 407956 [SourceCodester Drug Recommendation System 1.0 add_symptom txtname クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|