Submeter #918487: Amir Sanni Mini Inventory and Sales Management System 1.0 Cross Site Scripting (persistent)

The Mini Inventory and Sales Management System by Amir Sanni is
vulnerable to stored Cross-Site Scripting (XSS) via the Item Name
parameter in the Items management module.

Root Cause:
1. No input sanitization - The itemName field in Items.php only
validates length and uniqueness, with no strip_tags or XSS
filtering (global_xss_filtering is FALSE in config.php).
2. No output encoding - itemslisttable.php outputs the item name
directly into HTML using bare <?= without htmlspecialchars(),
allowing the raw payload to be rendered in browsers.

Proof of Concept:
1. Log in as [email protected] / demopass
2. Navigate to Items > Add Item
3. Enter <img src=x onerror=alert(1)> as the Item Name
4. Save - the payload executes immediately on the items list page
and also triggers in transaction listings, receipts, and event logs.

Impact:
Session hijacking, account takeover via credential harvesting,
privilege escalation through CSRF-like actions on behalf of
victims, and data exfiltration - all achievable with a single
injected payload that persists in the database.

This vulnerability is distinct from CVE-2024-42550, which affected
the email template Title field. The code paths and affected files
are entirely different.

Affected files:
- application/controllers/Items.php (input)
- application/views/items/itemslisttable.php (output)
- application/views/transactions/transtable.php (output)
- application/views/transactions/transreceipt.php (output)

• Utilizador: stephen30 (UID 100432)
• Submissão: 07/08/2026 09h15 (há 2 meses)
• Moderação: 27/09/2026 11h14 (2 months later)
• Estado: Aceite
• Entrada VulDB: 410856 [amirsanni mini-inventory-and-sales-management-system até 81bf0b55f5933f3b0dbb1583204a612e06605b95 Items Management Items.php itemName Script de Site Cruzado]
• Pontos: 17