Description

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-10T00:17:24.567Z",
  "pubdate": "2026-09-10T00:17:24.567Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the Login Page component of the Rizwan17 inventory-management-system, specifically affecting commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and prior versions. The vulnerability resides in the improper sanitization of the 'msg' argument within 'index.php'.\nThis flaw allows remote attackers to inject malicious JavaScript into the web page, which is then executed within the context of the victim's browser session. Successful exploitation can lead to session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information. The risk is significant as the exploit has been publicly disclosed, increasing the likelihood of malicious actors leveraging this defect against unpatched deployments. As the product lacks formal versioning, all users utilizing the codebase up to the specified commit hash should consider their installations affected.",
  "technicalDetails": "The vulnerability is a classic case of Reflected Cross-Site Scripting (XSS) stemming from the application's failure to adequately sanitize user-supplied input before rendering it back to the client browser. In the context of the inventory-management-system, the 'index.php' file processes the 'msg' URL argument, likely intended for displaying status or error notifications to users upon login attempts.\nThe root cause is the lack of output encoding or input validation on the 'msg' parameter. When the application receives a request, it directly embeds the contents of the 'msg' parameter into the HTML output stream of the Login Page. An attacker can manipulate this argument by crafting a URL containing malicious script tags, such as '<script>alert(document.cookie)</script>', and tricking a legitimate user into navigating to the crafted URI.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious URL targeting 'index.php' with a payload injected into the 'msg' query parameter. 2) The attacker distributes this link to targets, often via social engineering or phishing. 3) When an authenticated or unauthenticated user clicks the link, the server processes the request and mirrors the malicious script back to the user's browser in the response body. 4) The victim's browser interprets the injected script as legitimate code originating from the trusted domain, resulting in execution. 5) The payload executes within the security context of the origin, granting the attacker access to cookies, local storage, or the ability to manipulate the Document Object Model (DOM) of the page.\nThis vulnerability is reachable remotely and does not require prior authentication, as the login page is typically exposed to the public. The impact is critical, as it provides a vector for session theft, credential harvesting, and redirection of users to malicious third-party domains. Because the project has not responded to vulnerability reports and the exploit is publicly available, the system remains in a high-risk state with no official patch currently provided by the maintainers."
}