| 标题 | itsourcecode Online Medicine Delivery System v1.0 Cross Site Scripting |
|---|
| 描述 | 1. Description
The order details page /index.php?q=orderdetails of Online Medicine Delivery System contains a reflected XSS vulnerability. The page receives the $_POST['location'] parameter and directly outputs it in 3 different HTML contexts without any HTML entity encoding (htmlspecialchars/htmlentities) processing:
(1) Echo inside HTML tags (lines 122-123): Directly output within a <span> tag in the Delivery Fee area
(2)Echo inside HTML attributes (line 119): Directly output within the value attribute of an <input> tag
(3)Echo after arithmetic operation (lines 128-130): In the Overall Price area, the location value participates in arithmetic calculation before being output
(4)The first echo point is the most direct XSS exploitation point, as the JavaScript code submitted by the attacker is directly parsed and executed by the browser.
2. Impact
(1)Cookie Theft/Session Hijacking: An attacker can steal the victim's Session ID via document.cookie, taking over their account
(2)Phishing Attacks: Can inject forged login forms to trick users into entering credentials |
|---|
| 来源 | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/H-06-XSS-Reflected-OrderDetails_en.md |
|---|
| 用户 | xwniscoming2002 (UID 99874) |
|---|
| 提交 | 2026-07-16 15時51分 (2 月前) |
|---|
| 管理 | 2026-09-03 15時15分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 398415 [itsourcecode Online Medicine Delivery System 1.0 index.php?q=orderdetails location 跨网站脚本] |
|---|
| 积分 | 20 |
|---|