Executive brief
The SourceCodester Sales and Inventory System, a web application used for managing business transactions and stock, contains a security flaw in its record deletion feature. An attacker can use this flaw to execute malicious scripts in the browser of a logged-in user, such as an administrator. If successful, this could allow the attacker to hijack administrative sessions, steal sensitive cookies, or perform unauthorized actions within the system.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 within the 'delete.php' component. The application fails to properly sanitize or encode the 'id' GET parameter before reflecting it back into the HTTP response. A remote attacker can exploit this by tricking an authenticated user (typically an administrator) into clicking a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking via cookie theft or unauthorized state-changing requests. A public exploit (PoC) is available.
Affected products
- SourceCodester Sales and Inventory System 1.0
Timeline
- 2026-04-08: disclosed: Vulnerability published on NVD/VulDB