CVE-2025-9921
BaseFortify
Publication date: 2025-09-03
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code-projects | pos_pharmacy_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9921 is a stored Cross-Site Scripting (XSS) vulnerability in the POS Pharmacy System 1.0, specifically in the products.php file. It occurs because product information fields like product_code, gen_name, product_name, and supplier are output directly into the HTML page without escaping special characters. Attackers can inject malicious JavaScript code via product addition or editing functions, which is then stored in the database. When users visit the products.php page, the malicious scripts execute in their browsers. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to session hijacking, theft of sensitive information, phishing attacks, and unauthorized administrative actions such as data tampering or deletion. Because the malicious scripts execute in the browsers of users including administrators, attackers can escalate permissions and compromise the integrity of the web application. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable products.php page in the POS Pharmacy System and testing the input fields product_code, gen_name, product_name, and supplier for stored XSS payloads. A practical detection method includes injecting a harmless script such as <script>alert('XSS')</script> into these fields during product addition or editing and then visiting the products.php page to see if the script executes. Additionally, vulnerable targets can be identified using Google dorking with the query: inurl:main/products.php. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying output encoding using PHP's htmlspecialchars() function on all user-controllable data before rendering it in HTML, enforcing strict input validation on product addition and editing pages (such as addproduct.php and editproduct.php) by restricting special characters through a whitelist, and implementing a global output filtering function (e.g., escape_output()) to consistently sanitize all dynamic content. If possible, consider replacing the affected product with an alternative until a patch is available. [1, 2]