Description

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T07:17:47.120Z",
  "pubdate": "2026-08-31T07:17:47.120Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in Simple Inventory System 1.0 within the /register.php file. The vulnerability originates from improper neutralization of user-supplied input provided via the 'last_name' parameter during the user registration process. This flaw allows an unauthenticated, remote attacker to inject and execute arbitrary JavaScript code within the context of a victim's browser session. Successful exploitation can lead to session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information. Given that this exploit is publicly disclosed, the risk of exploitation is elevated. Organizations utilizing this version are advised to restrict access to affected components and implement robust input validation mechanisms.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw located in the user registration module of Simple Inventory System 1.0. Specifically, the /register.php file fails to perform adequate sanitization or output encoding on the 'last_name' parameter before rendering it back to the end-user or administrator within the application's interface.\nThe attack flow begins when an attacker crafts a malicious payload containing JavaScript, such as <script>alert('XSS')</script> or more sophisticated vectors designed to steal session cookies or credentials. This payload is passed as the value for the 'last_name' argument during the HTTP POST request to the /register.php endpoint.\nBecause the application does not validate or sanitize this input, the malicious script is stored or reflected back into the HTTP response delivered to the browser. When the victim—who could be an administrator viewing the registered user list or a user revisiting the registration feedback page—loads the page, the browser interprets the injected script as legitimate code originating from the trusted domain.\nTechnically, the lack of context-aware output encoding means that special characters (e.g., <, >, \", ') are not converted into their corresponding HTML entities. Consequently, the browser's Document Object Model (DOM) parser treats these characters as structural markers for tags rather than literal text content. This facilitates the execution of arbitrary scripts within the security origin of the Simple Inventory System application.\nThe impact is significant: an attacker can bypass Same-Origin Policy (SOP) protections to perform actions on behalf of the user, access administrative functionality, or scrape sensitive data displayed on the page. Since the vulnerability is remotely exploitable without requiring prior authentication, it poses a severe threat to the integrity and confidentiality of the application's user base. The exploit is currently publicly known, lowering the barrier to entry for potential attackers looking to weaponize this flaw against vulnerable deployments."
}