Cross-Site Scripting in Inventory System 1.0

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester Inventory System 1.0. It occurs in the Product Management component where user input for Product_Id or Product_Name is not properly sanitized when saving a product via the /api/products_handler.php?action=save endpoint. The malicious script is stored in the database and later executed in users' browsers when they visit the /products.php page.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability, inspect the /api/products_handler.php?action=save endpoint for unsanitized Product_Id and Product_Name parameters. Check if user input is reflected in /products.php without proper HTML encoding. Use browser developer tools to inspect network requests and responses for stored payloads. Test by injecting a simple XSS payload like <script>alert(1)</script> in these fields and verify if it executes when the page loads.

• Check PHP code for missing htmlspecialchars() calls when outputting database values.
• Verify if DataTables uses innerHTML without text escaping in /assets/js/app.js.
• Inspect session cookie for missing HttpOnly flag using browser dev tools.

Useful 0 Not Useful 0

Impact Analysis

An attacker can inject malicious scripts that execute when users visit the products page. This could lead to session cookie theft via document.cookie, allowing full account takeover without credentials. Attackers could access sensitive data like customer PII or financial records and modify or delete records.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, unauthorized disclosures, and failure to maintain data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Apply server-side output encoding using htmlspecialchars() for all user-supplied data rendered in PHP. Update DataTables to use text escaping functions instead of innerHTML. Set HttpOnly, Secure, and SameSite flags on the session cookie. Sanitize Product_Id and Product_Name inputs before saving to the database.

• Patch the /api/products_handler.php file to encode outputs and sanitize inputs.
• Modify /assets/js/app.js to use DataTables' text escaping methods.
• Update PHP session configuration to enforce HttpOnly and Secure cookie attributes.

Useful 0 Not Useful 0