| 제목 | SourceCodester Stock Management System v1.0 V1.0 XSS |
|---|
| 설명 | - A Stored XSS vulnerability was found in the `/php_action/printOrder.php` file of the "Stock Management System" project. The vulnerability stems from the `clientName` and `clientContact` fields submitted via `php_action/createOrder.php`, which are stored in the database without any sanitization. When `printOrder.php` retrieves and outputs these values directly into raw HTML without `htmlspecialchars()` or any output encoding, malicious script code injected during order creation is executed in the victim''s browser when the print order page is accessed.
- Attackers can exploit this Stored XSS vulnerability to steal cookies, session tokens, or other sensitive information of any user who views the print order page. The attacker can perform actions on behalf of the victim, deface web pages, redirect users to malicious websites, and even gain control of the victim''s browser, posing a serious threat to user privacy and system security.
- During the security review of "Stock Management System", I discovered a critical Stored XSS vulnerability in the "/php_action/printOrder.php" file. This vulnerability stems from insufficient input validation when creating orders and lack of output encoding when printing orders. Attackers can inject malicious script code through the client name or contact fields when creating an order, which is then stored in the database and executed whenever an administrator views the print order page. |
|---|
| 원천 | ⚠️ https://github.com/i-QvQ-i/first-OvO/issues/12 |
|---|
| 사용자 | i-OvO-i (UID 97659) |
|---|
| 제출 | 2026. 07. 06. PM 09:06 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 22. PM 12:12 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394299 [SourceCodester Stock Management System 1.0 printOrder.php clientName/clientContact 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|