CVE-2026-10247
Cross-Site Scripting in Pharmacy Sales and Inventory System
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | pharmacy_sales_and_inventory_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Cross-Site Scripting (XSS) vulnerability in the Pharmacy Sales and Inventory System allows attackers to execute arbitrary scripts in a victim's browser, potentially stealing sensitive information such as cookies or session tokens.
Such unauthorized access to sensitive data could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and health-related information against unauthorized access and breaches.
Therefore, this vulnerability may negatively impact compliance with these standards by exposing sensitive user data to attackers.
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue found in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically in the function create_generic_name within the file /ShowForm/create_generic_name/main.
The problem occurs because the user input from the 'generic_name' parameter is directly output to the web page without proper encoding or filtering. This allows attackers to inject malicious scripts that can execute in the browsers of users who visit the affected page.
How can this vulnerability impact me? :
Exploitation of this vulnerability can allow attackers to execute arbitrary scripts in a victim's browser. This can lead to several harmful impacts including:
- Stealing sensitive information such as cookies or session tokens.
- Performing unauthorized actions on behalf of the user.
- Defacing web pages.
- Redirecting users to malicious websites.
Additionally, the attack can be launched remotely and does not require login or authorization, increasing the risk of exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the 'generic_name' parameter in the URL path '/ShowForm/create_generic_name/main' for cross-site scripting (XSS) issues. You can attempt to inject common XSS payloads into the 'generic_name' parameter and observe if the input is reflected unencoded in the web page.
- Use curl or similar tools to send requests with XSS payloads, for example: curl -v "http://target/ShowForm/create_generic_name/main?generic_name=<script>alert(1)</script>"
- Use browser developer tools or automated scanners to check if the injected script executes or appears in the page source unencoded.
- Employ web vulnerability scanners that test for reflected XSS vulnerabilities on the affected endpoint.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing proper output encoding and strict input validation on the 'generic_name' parameter to prevent injection of malicious scripts.
- Apply output encoding to all user-supplied data before rendering it in the web page.
- Implement strict input validation to allow only expected characters or patterns in the 'generic_name' parameter.
- Use Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts.
- Set secure and HttpOnly flags on cookies to protect session tokens from being accessed via scripts.
- Conduct regular security audits and code reviews to identify and fix similar vulnerabilities.