| 标题 | SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database 1.0 Cross Site Scripting |
|---|
| 描述 | A Cross-Site Scripting (XSS) vulnerability (CWE-79) was found in SourceCodester Drug Recommendation System Using Machine Learning, PHP, and MySQL Database v1.0. The issue affects the /drug_recommender/Admin/add_symptom endpoint through the txtname POST parameter. User input is reflected back into the HTML response without proper output encoding, allowing an authenticated attacker to inject and execute JavaScript in the administrator's browser. Testing also showed that the PHPSESSID session cookie could be accessed through JavaScript because the cookie does not have the HttpOnly flag, which could potentially lead to session hijacking and unauthorized access to administrator functionality and sensitive application data.
Product Website:
https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html
RESEARCHERS:
Researcher 1: Karan Parelkar
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher 2: Anubhav Verma
Email: [email protected]
GitHub: https://github.com/anubhavv106
LinkedIn: https://www.linkedin.com/in/anubhav-verma-7123a1232/
Researcher 3: Parth Desai
Email: [email protected]
GitHub: https://github.com/ParthD31
LinkedIn: https://www.linkedin.com/in/parth-desai-801951224/ |
|---|
| 来源 | ⚠️ https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_symptom/Readme.md |
|---|
| 用户 | anubhav106 (UID 98769) |
|---|
| 提交 | 2026-08-24 15時53分 (26 日前) |
|---|
| 管理 | 2026-09-19 17時22分 (26 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 407956 [SourceCodester Drug Recommendation System 1.0 add_symptom txtname 跨网站脚本] |
|---|
| 积分 | 20 |
|---|