Executive brief
SourceCodester Queue Management System is a web-based application used to manage customer queues. A cross-site scripting (XSS) vulnerability in the customer add function allows an attacker to inject malicious scripts that can be stored and executed when other users access the affected page, potentially stealing user credentials or session data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Queue Management System 1.0 within the /api/add_customer.php endpoint. The vulnerability arises from insufficient input validation or output encoding of the "Name" parameter, which allows an attacker to inject arbitrary JavaScript code. The attack requires network access to the vulnerable endpoint and does not require authentication. When a user adds a customer with a malicious name payload, the script is stored in the application and executed in the context of any user viewing the affected data, enabling session hijacking, credential theft, or account takeover. Patches or vendor updates should be applied to the affected version.
Affected products
- SourceCodester Queue Management System 1.0
Timeline
- 2026-08-30: disclosed