| Название | itsourcecode Online Medicine Delivery System v1.0 Cross Site Scripting |
|---|
| Описание | 1. Description
The order details page /index.php?q=orderdetails of Online Medicine Delivery System contains a reflected XSS vulnerability. The page receives the $_POST['location'] parameter and directly outputs it in 3 different HTML contexts without any HTML entity encoding (htmlspecialchars/htmlentities) processing:
(1) Echo inside HTML tags (lines 122-123): Directly output within a <span> tag in the Delivery Fee area
(2)Echo inside HTML attributes (line 119): Directly output within the value attribute of an <input> tag
(3)Echo after arithmetic operation (lines 128-130): In the Overall Price area, the location value participates in arithmetic calculation before being output
(4)The first echo point is the most direct XSS exploitation point, as the JavaScript code submitted by the attacker is directly parsed and executed by the browser.
2. Impact
(1)Cookie Theft/Session Hijacking: An attacker can steal the victim's Session ID via document.cookie, taking over their account
(2)Phishing Attacks: Can inject forged login forms to trick users into entering credentials |
|---|
| Источник | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md |
|---|
| Пользователь | xwniscoming2002 (UID 99874) |
|---|
| Представление | 16.07.2026 15:51 (2 месяцы назад) |
|---|
| Модерация | 03.09.2026 15:15 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 398415 [itsourcecode Online Medicine Delivery System 1.0 index.php?q=orderdetails location межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|