CVE-2026-7390

Vulnerability

Overview

CVE-2026-7390 describes a reflected cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw resides in the /index.php?page=customer file, where the name parameter is echoed back to the user without proper sanitization or output encoding. This allows an attacker to inject arbitrary HTML and JavaScript code into the page [1].

Exploitation

Details

The attack can be launched remotely and does not require authentication. An attacker can craft a malicious URL containing a payload in the name parameter, such as <script>prompt(/xss/);</script>. When a victim visits this URL, the script executes in their browser context. The vulnerability is publicly disclosed with a proof-of-concept exploit [1].

Impact

Successful exploitation enables an attacker to steal cookies, session tokens, or other sensitive information, perform actions on behalf of the victim, deface web pages, redirect users to malicious sites, or gain control of the victim's browser. This poses a risk to user privacy and system security [1].

Mitigation

As of the publication date, no official patch has been released by SourceCodester. Users should apply input validation and output encoding for the name parameter, or consider migrating to a maintained alternative. The vendor's homepage provides the software download link [2].