| 제목 | Amir Sanni Mini Inventory and Sales Management System 1.0 Cross Site Scripting (persistent) |
|---|
| 설명 | The Mini Inventory and Sales Management System by Amir Sanni is
vulnerable to stored Cross-Site Scripting (XSS) via the Item Name
parameter in the Items management module.
Root Cause:
1. No input sanitization - The itemName field in Items.php only
validates length and uniqueness, with no strip_tags or XSS
filtering (global_xss_filtering is FALSE in config.php).
2. No output encoding - itemslisttable.php outputs the item name
directly into HTML using bare <?= without htmlspecialchars(),
allowing the raw payload to be rendered in browsers.
Proof of Concept:
1. Log in as [email protected] / demopass
2. Navigate to Items > Add Item
3. Enter <img src=x onerror=alert(1)> as the Item Name
4. Save - the payload executes immediately on the items list page
and also triggers in transaction listings, receipts, and event logs.
Impact:
Session hijacking, account takeover via credential harvesting,
privilege escalation through CSRF-like actions on behalf of
victims, and data exfiltration - all achievable with a single
injected payload that persists in the database.
This vulnerability is distinct from CVE-2024-42550, which affected
the email template Title field. The code paths and affected files
are entirely different.
Affected files:
- application/controllers/Items.php (input)
- application/views/items/itemslisttable.php (output)
- application/views/transactions/transtable.php (output)
- application/views/transactions/transreceipt.php (output) |
|---|
| 사용자 | stephen30 (UID 100432) |
|---|
| 제출 | 2026. 08. 07. AM 09:15 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. AM 11:14 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 410856 [amirsanni mini-inventory-and-sales-management-system 까지 81bf0b55f5933f3b0dbb1583204a612e06605b95 Items Management Items.php itemName 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|