Description

A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/add_customer.php. This manipulation of the argument Name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T18:17:00.180Z",
  "pubdate": "2026-08-30T18:17:00.180Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the SourceCodester Queue Management System 1.0. The flaw is located within the /api/add_customer.php endpoint, specifically targeting the Name argument. This vulnerability allows an unauthenticated or remote attacker to inject arbitrary malicious scripts into the application's client-side context.\nThe primary impact of this vulnerability is the compromise of user sessions, potential theft of sensitive cookies or session tokens, and the ability for an attacker to perform unauthorized actions on behalf of the victim. By leveraging this reflected XSS, an attacker can manipulate the Document Object Model (DOM), redirect users to malicious domains, or deface the application interface. Given that the exploit has been publicly disclosed, the risk of exploitation by threat actors is elevated. The vulnerability is exploitable remotely, requiring no specific privileges or complex authentication hurdles, making it a critical concern for deployments of the SourceCodester Queue Management System 1.0.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate input validation and output encoding on the Name argument processed by the /api/add_customer.php script. In the affected component, the application accepts user-supplied data through the Name parameter and reflects it back to the browser without sufficient sanitization or transformation of special characters.\nRoot Cause Analysis: The lack of server-side input filtering allows for the injection of HTML tags and JavaScript payloads. When a user or administrator views the output generated by the script, the browser interprets the injected payload as executable code rather than plain text. This is a classic Reflected Cross-Site Scripting (XSS) flaw, where the malicious payload is part of the request sent to the server and immediately returned in the HTTP response.\nAttack Flow: An attacker crafts a malicious URI containing a JavaScript payload within the Name parameter. For example, a payload such as <script>alert('XSS')</script> or event handlers like onmouseover or onload can be injected. When a target user, such as an administrator, clicks a link containing this crafted payload, the browser sends the request to /api/add_customer.php. The server processes the request and embeds the raw, unencoded payload into the response body. Upon receiving the response, the victim's browser parses the malicious script, executing it within the security context of the origin. This allows the attacker to hijack the session, steal local storage data, or execute arbitrary API calls while masquerading as the victim.\nExposure and Impact: The vulnerability is remotely exploitable over HTTP/HTTPS, and because it does not require prior authentication in many deployment configurations, it presents a significant surface for session hijacking. The impact is persistent for the duration of the victim's session, potentially leading to full account takeover if administrative cookies are harvested. The post-exploitation phase allows the attacker to gain persistence through DOM-based modifications or by chaining the script execution to redirect the user to a secondary, attacker-controlled site designed for credential harvesting or malware distribution."
}