| 제목 | itsourcecode Online Medicine Delivery System v1.0 Cross Site Scripting |
|---|
| 설명 | 1. Description
The order details page /index.php?q=orderdetails of Online Medicine Delivery System contains a reflected XSS vulnerability. The page receives the $_POST['location'] parameter and directly outputs it in 3 different HTML contexts without any HTML entity encoding (htmlspecialchars/htmlentities) processing:
(1) Echo inside HTML tags (lines 122-123): Directly output within a <span> tag in the Delivery Fee area
(2)Echo inside HTML attributes (line 119): Directly output within the value attribute of an <input> tag
(3)Echo after arithmetic operation (lines 128-130): In the Overall Price area, the location value participates in arithmetic calculation before being output
(4)The first echo point is the most direct XSS exploitation point, as the JavaScript code submitted by the attacker is directly parsed and executed by the browser.
2. Impact
(1)Cookie Theft/Session Hijacking: An attacker can steal the victim's Session ID via document.cookie, taking over their account
(2)Phishing Attacks: Can inject forged login forms to trick users into entering credentials |
|---|
| 원천 | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md |
|---|
| 사용자 | xwniscoming2002 (UID 99874) |
|---|
| 제출 | 2026. 07. 16. PM 03:51 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 03. PM 03:15 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 398415 [itsourcecode Online Medicine Delivery System 1.0 index.php?q=orderdetails location 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|