SourceCodester Best Courier Management System Manage Account Page cross site scripting

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the Manage Account Page of SourceCodester Best Courier Management System 1.0. The First Name parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code when the parameter is processed and displayed on the page.

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the Manage Account endpoint with a malicious payload in the First Name parameter. No authentication is required to deliver the payload, but the attack relies on an authenticated administrator viewing the affected page. The exploit has been publicly disclosed in a proof-of-concept [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript within the context of the administrator's session. This can lead to session hijacking, defacement, or theft of sensitive information displayed on the page.

Mitigation

Currently, no official patch or advisory has been released by SourceCodester. Users are advised to implement input validation and output encoding for the First Name parameter, or restrict access to the Manage Account page until a fix is available.