Executive brief
SourceCodester Inventory Management System is a web-based product inventory and customer management application. An authenticated attacker can inject malicious JavaScript into customer name fields, which is stored in the database and executed whenever any user views the customer list page. This enables session hijacking, account takeover, and unauthorized access to sensitive business data.
Technical details
The application fails to sanitize or encode the Customer_Name parameter before storing it in the database or rendering it on the customer list page (/customers.php and /api/customers_handler.php). An authenticated user can submit a POST request with injected JavaScript in the Customer_Name field, which is stored directly in the database. When the customer list is rendered, the stored script executes in the victim's browser without escaping, allowing session cookie theft and account takeover. Authentication is required, but any valid account can exploit this vulnerability. The recommended fix involves using htmlspecialchars() for output encoding, server-side input validation, and Content Security Policy headers.
Affected products
- SourceCodester Inventory Management System 1.0
Timeline
- 2026-08-05: disclosed
- 2026-09-14: advisory