code-projects Point of Sales and Inventory Management System checkout.php cross site scripting

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Point of Sales and Inventory Management System version 1.0. The flaw resides in the file /main/checkout.php at line 103, where the pt parameter is retrieved from user input and echoed directly into the HTML output without proper sanitization or encoding [1]. This allows an attacker to inject arbitrary JavaScript code via the pt parameter.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a JavaScript payload in the pt parameter and tricking an authenticated administrator into visiting it. No authentication is required to trigger the XSS; the attack is performed remotely. The reference provides a proof-of-concept URL: http://192.168.211.1/pisp/main/checkout.php?pt=">&invoice=RS-38223922&total=&totalprof=&cashier=Administrator [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the administrator's browser session. This can lead to theft of session cookies, enabling the attacker to impersonate the administrator and gain unauthorized access to the application's administrative functions. The impact is limited to the browser session of the victim, but can result in full compromise of the application's administrative interface.

Mitigation

As of the publication date (2023-12-22), no official patch or fixed version has been released by the vendor. The application appears to be unmaintained. Users should implement input validation and output encoding for all user-supplied data, particularly the pt parameter in /main/checkout.php. Additionally, deploying a Web Application Firewall (WAF) or Content Security Policy (CSP) can help mitigate exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.