Executive brief
SourceCodester Sales and Inventory System is a web application used for managing business sales and stock. A security flaw in the product viewing page allows attackers to send a malicious link to a logged-in user, such as an administrator. If the user clicks the link, the attacker can execute unauthorized code in their browser, potentially leading to the theft of login sessions or unauthorized changes to inventory data.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 within the view_product.php component. The application fails to sanitize the 'limit' GET parameter before reflecting it in the HTML response. An unauthenticated remote attacker can exploit this by tricking a logged-in user into clicking a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to steal session cookies or perform actions on behalf of an authenticated administrator.
Affected products
- SourceCodester Sales and Inventory System 1.0
Timeline
- 2026-03-27: advisory: Initial disclosure and NVD publication
- 2026-03-27: disclosed: Vulnerability reported by MITRE