Description

A vulnerability has been found in SourceCodester Stock Management System 1.0. This vulnerability affects unknown code of the file /php_action/printOrder.php. Such manipulation of the argument clientName/clientContact leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-23T04:16:54.387Z",
  "pubdate": "2026-08-23T04:16:54.387Z",
  "executiveSummary": "A security vulnerability has been identified in SourceCodester Stock Management System 1.0, specifically within the /php_action/printOrder.php endpoint.\nThe vulnerability is classified as Cross-Site Scripting (XSS), arising from the improper handling of user-supplied input.\nSpecifically, manipulation of the clientName or clientContact parameters allows remote attackers to inject malicious scripts into the application's output.\nThe primary impact of this vulnerability includes the execution of arbitrary JavaScript in the context of a victim's browser session, which can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of the user.\nThe affected system is SourceCodester Stock Management System version 1.0.\nThe risk implications are moderate to high depending on user interaction and privilege levels, as the exploit can be executed remotely without prior authentication depending on endpoint accessibility.\nAttackers require network access to the target application to deliver the malicious payload via the vulnerable parameters.",
  "technicalDetails": "The vulnerability resides in the /php_action/printOrder.php file of SourceCodester Stock Management System 1.0.\nThe root cause of the issue is inadequate input sanitization and output encoding of HTTP request parameters.\nSpecifically, the clientName and clientContact parameters accept user input and reflect it back within the generated HTTP response without appropriate contextual neutralization of special characters such as angle brackets and quotation marks.\nThis allows an attacker to inject arbitrary HTML or JavaScript payloads into the data stream.\nThe attack flow proceeds as follows: An attacker crafts a malicious URL or submits a crafted HTTP request containing JavaScript payloads within the clientName or clientContact parameters to the vulnerable /php_action/printOrder.php script.\nWhen a user or administrator subsequently accesses the generated print order view, the server processes the request and renders the unsanitized input directly into the HTML document body or script context.\nThe victim's browser interprets the injected string as executable code rather than plain text, resulting in script execution.\nThe vulnerable component is the parameter handling and rendering logic within /php_action/printOrder.php.\nThe affected version is strictly version 1.0 of the software.\nThe attack vector is remote, operating over standard web protocols (HTTP/HTTPS).\nDepending on the exact deployment configuration, exploitation may be performed without authentication if the print order functionality is publicly accessible or exposed to unauthenticated users.\nPost-exploitation impact includes the potential theft of session cookies, manipulation of the Document Object Model (DOM), redirection to malicious external sites, or execution of privileged actions if the victim is an authenticated administrator."
}