| 제목 | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| 설명 | A Cross-Site Scripting (XSS) vulnerability (CWE-79) was found in SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database v1.0. The issue affects the /drug_recommender/Admin/add_symptom endpoint through the txtname POST parameter. User input is reflected back into the HTML response without proper output encoding, allowing an authenticated attacker to inject and execute JavaScript in the administrator's browser. Testing also showed that the PHPSESSID session cookie could be accessed through JavaScript because the cookie does not have the HttpOnly flag, which could potentially lead to session hijacking and unauthorized access to administrator functionality and sensitive application data.
Product Website:
https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html
RESEARCHERS:
Researcher 1: Karan Parelkar
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher 2: Anubhav Verma
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher 3: Parth Desai
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/ |
|---|
| 원천 | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md |
|---|
| 사용자 | anubhav106 (UID 98769) |
|---|
| 제출 | 2026. 08. 24. PM 03:53 (27 날 ago) |
|---|
| 모더레이션 | 2026. 09. 19. PM 05:22 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 407956 [SourceCodester Drug Recommendation System 1.0 add_symptom txtname 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|