Description

A vulnerability was found in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /php_action/getOrderReport.php. Performing a manipulation of the argument clientName/clientContact results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-23T04:17:08.610Z",
  "pubdate": "2026-08-23T04:17:08.610Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in SourceCodester Stock Management System 1.0, specifically within an unknown processing routine of the /php_action/getOrderReport.php endpoint. This security flaw arises from the improper neutralization of user-supplied input passed via the clientName or clientContact parameters, allowing remote attackers to inject malicious client-side scripts into generated web pages. When an unsuspecting user or administrator views the compromised report, the injected payload executes within the context of their browser session, potentially leading to session hijacking, credential theft, or the execution of unauthorized actions within the application. The vulnerability presents significant risk implications because the exploit mechanism has been made publicly available, lowering the barrier to entry for potential threat actors. Remote exploitation is achievable without requiring prior authentication, depending on the network exposure of the target system. Remediation requires implementing robust input sanitization and context-aware output encoding across all affected parameters within the reporting functionality to ensure malicious scripts cannot be injected or reflected back to the user.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw affecting the SourceCodester Stock Management System 1.0 application. The vulnerable component resides within the backend processing logic associated with the /php_action/getOrderReport.php script. The root cause of the vulnerability is the absence of adequate input validation and output encoding mechanisms for parameters handling user-submitted data, specifically clientName and clientContact. In a standard execution flow, the application accepts input values through these parameters, processes them within order report generation routines, and subsequently reflects the data back to the client-side interface within HTTP responses without properly sanitizing special characters such as angle brackets, quotes, or script delimiters.\nExploitation of this vulnerability occurs remotely by an unauthenticated attacker who crafts a malicious HTTP request or constructs a specially formatted URL containing JavaScript payloads within the clientName or clientContact parameters. When the target application processes the request and generates the order report via /php_action/getOrderReport.php, the unsanitized payload is embedded directly into the HTML document structure. When a victim accesses the generated report or interacts with the malicious data output, the web browser interprets the injected payload as legitimate executable script code rather than plain text data.\nThe payload behavior in this context includes the execution of arbitrary JavaScript within the security context of the victim's active session. Depending on the intent of the attacker, post-exploitation impact may involve the theft of sensitive session cookies, DOM manipulation, redirection to malicious external sites, or the unauthorized performance of administrative or transactional actions on behalf of the victim. Because the exploit vector is publicly available, automated or manual exploitation can be easily orchestrated against vulnerable instances exposed to the network."
}