| 标题 | Amir Sanni Mini Inventory and Sales Management System 1.0 Cross Site Scripting (persistent) |
|---|
| 描述 | The Mini Inventory and Sales Management System by Amir Sanni is
vulnerable to stored Cross-Site Scripting (XSS) via the Item Name
parameter in the Items management module.
Root Cause:
1. No input sanitization - The itemName field in Items.php only
validates length and uniqueness, with no strip_tags or XSS
filtering (global_xss_filtering is FALSE in config.php).
2. No output encoding - itemslisttable.php outputs the item name
directly into HTML using bare <?= without htmlspecialchars(),
allowing the raw payload to be rendered in browsers.
Proof of Concept:
1. Log in as [email protected] / demopass
2. Navigate to Items > Add Item
3. Enter <img src=x onerror=alert(1)> as the Item Name
4. Save - the payload executes immediately on the items list page
and also triggers in transaction listings, receipts, and event logs.
Impact:
Session hijacking, account takeover via credential harvesting,
privilege escalation through CSRF-like actions on behalf of
victims, and data exfiltration - all achievable with a single
injected payload that persists in the database.
This vulnerability is distinct from CVE-2024-42550, which affected
the email template Title field. The code paths and affected files
are entirely different.
Affected files:
- application/controllers/Items.php (input)
- application/views/items/itemslisttable.php (output)
- application/views/transactions/transtable.php (output)
- application/views/transactions/transreceipt.php (output) |
|---|
| 用户 | stephen30 (UID 100432) |
|---|
| 提交 | 2026-08-07 09時15分 (2 月前) |
|---|
| 管理 | 2026-09-27 11時14分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 410856 [amirsanni mini-inventory-and-sales-management-system 直到 81bf0b55f5933f3b0dbb1583204a612e06605b95 Items Management Items.php itemName 跨网站脚本] |
|---|
| 积分 | 17 |
|---|