CVE-2026-5810

Vulnerability

Overview

A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The flaw is located in the /delete.php file, where the id GET parameter is reflected into the response without proper sanitization or encoding [1]. This allows an attacker to inject arbitrary JavaScript code.

Exploitation

To exploit the vulnerability, an attacker crafts a URL containing a malicious payload in the id parameter. The proof-of-concept URL http://127.0.0.1:8089/delete.php?id=%3CscrIpt%3Ealert%281%29%3B%3C%2FscRipt%3E&table=customer_details&return=view_customers.php demonstrates that the payload is executed in the victim's browser [1]. The attack requires the victim to be authenticated as an administrator, as the delete action typically requires admin privileges [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the administrator's session. This can lead to session hijacking by stealing session cookies, privilege escalation by performing actions on behalf of the admin (e.g., adding rogue accounts), or forcing the browser to make unintended state-changing requests [1].

Mitigation

As of the publication date (2026-04-08), no official patch has been released by SourceCodester [2]. The vendor's recommended to sanitize and encode all user-supplied input before reflecting it in responses. The exploit has been publicly published, increasing the risk of active use [1].