Description

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers_handler.php of the component Customer Management Module. Such manipulation of the argument Customer_Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-14T08:16:35.850Z",
  "pubdate": "2026-09-14T08:16:35.850Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Customer Management Module of the SourceCodester Inventory Management System 1.0.\nThe vulnerability allows remote attackers to inject malicious scripts into the application via the 'Customer_Name' argument in '/api/customers_handler.php'.\nSuccessful exploitation enables an attacker to execute arbitrary client-side code within the context of a victim's browser session.\nThis can lead to unauthorized actions, session hijacking, credential theft, and unauthorized redirection of users.\nThe flaw is publicly disclosed and exploitable remotely, posing a significant risk to the integrity and confidentiality of user sessions.\nThe vulnerability stems from improper neutralization of user-supplied data before rendering it in the web interface.",
  "technicalDetails": "The vulnerability is identified as a Reflected or Stored Cross-Site Scripting (XSS) flaw located within the /api/customers_handler.php script of the Customer Management Module in SourceCodester Inventory Management System 1.0.\nThe root cause of this security weakness is the lack of adequate input validation and output encoding on the 'Customer_Name' parameter. The application fails to sanitize malicious script tags or special characters before processing or storing the data, allowing arbitrary HTML or JavaScript to be injected into the application's DOM.\nExploitation is achieved by supplying a crafted payload containing malicious JavaScript (e.g., <script>alert(document.cookie)</script>) within the 'Customer_Name' argument. When the application receives this input, it fails to encode the characters into a safe representation (such as HTML entities).\nThe attack flow follows a predictable sequence: First, the attacker identifies the vulnerable endpoint at /api/customers_handler.php. Second, the attacker crafts a malicious HTTP request targeting the 'Customer_Name' parameter. Third, upon processing the request, the server stores or reflects the unsanitized payload. Fourth, when an unsuspecting user or administrator navigates to the affected module or view, the browser executes the injected payload automatically in the context of the vulnerable application.\nBecause the payload executes within the victim's browser, the attacker can bypass Same-Origin Policy (SOP) protections to perform actions on behalf of the authenticated user. Potential post-exploitation impacts include the exfiltration of session tokens (e.g., PHPSESSID), forced redirection to malicious websites, unauthorized data modification via CSRF, and defacement of the application's interface. The vulnerability is accessible remotely and does not require complex infrastructure to weaponize, provided the attacker can reach the web interface. Given that public exploit code is available, this vulnerability constitutes a high risk for unauthorized access and session compromise in any deployment of SourceCodester Inventory Management System 1.0."
}