Description

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-08-15T18:16:25.183Z",
  "pubdate": "2026-08-15T18:16:25.183Z",
  "executiveSummary": "An unauthenticated or authenticated Cross-Site Scripting (XSS) vulnerability has been identified within the SourceCodester Online Book Store System 1.0. Specifically, this security flaw resides in the System Settings Module within the /admin/index.php?page=site_settings endpoint. The vulnerability allows remote attackers to inject malicious client-side scripts, typically JavaScript, into the application's generated output. When an administrative user or victim views the affected page, the injected payload executes within the context of their browser session, leading to potential session hijacking, credential theft, or unauthorized modification of system settings. Given that public exploit material exists, the risk profile is elevated, enabling threat actors to leverage automated or manual remote attacks against vulnerable deployments. Remediation requires strict input sanitization and contextual output encoding within the vulnerable component.",
  "technicalDetails": "The vulnerability is classified as Cross-Site Scripting (XSS), stemming from inadequate validation and sanitization of user-supplied data handled by the System Settings Module of the SourceCodester Online Book Store System 1.0. The vulnerable attack surface is exposed via the HTTP GET request parameter controlling or interacting with the /admin/index.php?page=site_settings file path.\nRoot Cause: The application insecurely accepts input intended for site settings configuration or rendering without enforcing proper character escaping or output encoding mechanisms. Consequently, arbitrary HTML and JavaScript payloads submitted to the application are stored or reflected directly into the Document Object Model (DOM) without prior neutralization.\nAttack Flow and Exploitation Method: 1. The remote attacker crafts a malicious payload containing executable JavaScript (e.g., event handlers or script tags). 2. The attacker delivers this payload to the vulnerable /admin/index.php?page=site_settings endpoint, either via direct injection into input fields associated with site configurations or through manipulated parameters. 3. The application processes the input and subsequently reflects or stores the raw payload within the administrative interface. 4. When a targeted user or administrator accesses the compromised settings page, the browser parses the malicious script as legitimate application code. 5. The payload executes within the victim's browser session, granting the attacker the ability to perform actions on behalf of the user, steal session cookies, or manipulate the web application interface."
}