Submit #1012166: SourceCodester Inventory System 1.0 Cross Site Scripting

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Inventory System 1.0. The vulnerability exists in the Purchase Records page (/purchases.php). The application does not sanitize user-supplied input for the Product_Name, Product_Code, and Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase. The malicious payloads are stored in the database and executed in the browser of any user who visits purchases.php. Multiple parameters are affected, allowing multiple XSS payloads to trigger simultaneously. DataTables renders stored data using innerHTML without encoding. The session cookie lacks the HttpOnly flag, enabling session theft and full account takeover.

PoC:
POST /product_inventory/Product_Inventory/api/transactions_handler.php?action=save_purchase
Content-Type: application/x-www-form-urlencoded

Product_Code=<img src=x onerror="alert('XSS-Product_Code')">&Product_Name=<img src=x onerror="alert('XSS-Product_Name')">&Hsn_Code=123&Vendor_Id=123&Vendor_Name=<img src=x onerror="alert('XSS-Vendor_Name')">&Purchase_Date=2026-10-02&Purchase_Units=123&Purchase_Cost=123&IGST=0&CGST=0&SGST=0&Total_Amount=100

Steps:
1. Login as any authenticated user
2. Send the above POST request
3. Navigate to /purchases.php
4. Multiple JavaScript alerts fire for Product_Code, Product_Name, and Vendor_Name
5. Attacker can steal admin session via document.cookie

• Source: ⚠️ https://github.com/Mohnad-AL-saif/MyCVEs/blob/main/VulDB/Inventory-System/CVE-02-XSS-purchases.md
• User: Muhannad AlSaif (UID 101875)
• Submission: 10/03/2026 00:40 (16 days ago)
• Moderation: 10/18/2026 19:10 (16 days later)
• Status: Accepted
• VulDB entry: 421920 [SourceCodester Inventory System 1.0 Purchase Records transactions_handler.php?action=save_purchase Product_Name/Product_Code/Vendor_Name cross site scripting]
• Points: 20