CVE-2026-5325

Vulnerability

Overview A reflected or stored cross-site scripting (XSS) vulnerability exists in SourceCodester Simple Customer Relationship Management System 1.0. The issue occurs in the /create-ticket.php file, where the Description parameter is not properly sanitized before being processed. This allows an attacker to inject malicious JavaScript or HTML code that will be executed in the context of the victim's browser.[1]

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the /create-ticket.php endpoint with a malicious payload in the Description field. No authentication is explicitly required, but the victim must view the affected ticket for the script to execute. Since the exploit has been publicly disclosed, exploitation is straightforward for an attacker with network access to the application.

Impact

The vulnerability carries a CVSS v3 base score of 3.5 (Low), indicating limited impact. Successful exploitation could lead to client-side attacks such as session hijacking, defacement, or phishing, but likely requires user interaction (e.g., an administrator viewing a ticket) and is constrained by browser security mechanisms.

Mitigation

As of the publication date, no official patch has been released. The vendor (SourceCodester) provides free source code projects, and users are advised to implement input validation and output encoding for the Description field. Given the low severity and public exploit availability, organizations using this system should consider applying a web application firewall (WAF) rule or upgrading to a supported version.