| 标题 | SourceCodester Stock Management System v1.0 V1.0 XSS |
|---|
| 描述 | - A Stored XSS vulnerability was found in the `/php_action/getOrderReport.php` file of the "Stock Management System" project. The vulnerability originates from the `clientName` and `clientContact` fields submitted via `php_action/createOrder.php`, which are stored in the MySQL database without any sanitization or filtering. When `getOrderReport.php` generates an HTML report table and outputs `client_name` and `client_contact` values directly into HTML `<td>` elements without `htmlspecialchars()` encoding, any malicious script code stored in the database is rendered and executed in the victim''s browser.
- Attackers can exploit this Stored XSS vulnerability to steal cookies, session tokens, or other sensitive information of any user who generates an order report. The payload is triggered when an administrator visits the report page and generates a report that includes the malicious order. This allows attackers to perform actions on behalf of the victim, deface web pages, redirect users to malicious websites, and gain control of the victim''s browser.
- During the security review of "Stock Management System", I discovered a critical Stored XSS vulnerability in the "/php_action/getOrderReport.php" file. Since order reports aggregate multiple orders, a single malicious order can compromise every administrator who views the report, making this a high-impact vulnerability requiring immediate remediation. |
|---|
| 来源 | ⚠️ https://github.com/i-QvQ-i/first-OvO/issues/13 |
|---|
| 用户 | i-OvO-i (UID 97659) |
|---|
| 提交 | 2026-07-06 21時59分 (2 月前) |
|---|
| 管理 | 2026-08-22 12時12分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394300 [SourceCodester Stock Management System 1.0 getOrderReport.php clientName/clientContact 跨网站脚本] |
|---|
| 积分 | 20 |
|---|