CVE-2026-7200

Vulnerability

Overview

A reflected cross-site scripting (XSS) vulnerability has been identified in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw resides in the /index.php?page=types file, where the id parameter is directly output to the web page without proper validation or encoding. This lack of sanitization enables attackers to inject arbitrary HTML and JavaScript code, which is then executed in the victim's browser [1].

Exploitation

Prerequisites

Exploitation does not require authentication or special privileges. An attacker can craft a malicious URL containing a script payload in the id parameter and trick a victim into clicking it. The vulnerability is remotely exploitable, and a proof-of-concept (PoC) has been published, increasing the risk of active attacks [1].

Impact

Successful exploitation allows an attacker to perform arbitrary actions in the context of the victim's session, including stealing cookies, session tokens, or other sensitive information. The attacker may also deface the web page, redirect users to malicious sites, or execute further client-side attacks, compromising user privacy and system security [1].

Mitigation

The vendor has not released an official patch at the time of writing. Users are advised to sanitize the id parameter and apply proper output encoding until a fix is available. Given the public exploit, this vulnerability warrants immediate attention to prevent potential attacks.