| Название | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| Описание | A Cross-Site Scripting (XSS) vulnerability (CWE-79) was found in SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database v1.0. The issue affects the /drug_recommender/Admin/add_symptom endpoint through the txtname POST parameter. User input is reflected back into the HTML response without proper output encoding, allowing an authenticated attacker to inject and execute JavaScript in the administrator's browser. Testing also showed that the PHPSESSID session cookie could be accessed through JavaScript because the cookie does not have the HttpOnly flag, which could potentially lead to session hijacking and unauthorized access to administrator functionality and sensitive application data.
Product Website:
https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html
RESEARCHERS:
Researcher 1: Karan Parelkar
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher 2: Anubhav Verma
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher 3: Parth Desai
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/ |
|---|
| Источник | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md |
|---|
| Пользователь | anubhav106 (UID 98769) |
|---|
| Представление | 24.08.2026 15:53 (27 дни назад) |
|---|
| Модерация | 19.09.2026 17:22 (26 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 407956 [SourceCodester Drug Recommendation System 1.0 add_symptom txtname межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|