SourceCodester Indian Invoicing System category.php cross site scripting

Vulnerability

SourceCodester Indian Invoicing System 1.0 (also referred to as Invoicing System In PHP 1.0) contains both a reflected cross-site scripting (XSS) and a SQL injection vulnerability in the file /Invoicing/category.php. The XSS is triggered by the msg argument in GET requests, whose value is reflected directly into the HTML response without HTML encoding. Additionally, the search filter field used in SQL queries lacks sanitization or prepared statements, enabling SQL injection. The affected versions are explicitly 1.0 of the project [1][2].

Exploitation

An attacker can initiate the attack remotely with a crafted HTTP GET request. For the reflected XSS, simply appending ?msg= to the endpoint URL causes the script to execute in the victim's browser when the page is loaded. No authentication is required for the XSS vector. For SQL injection, an attacker must pass a malicious payload such as admin' UNION SELECT 1,2,3,4,5,6 FROM users-- - via the search field on the same page to extract data from arbitrary database tables [2].

Impact

Successful exploitation of the XSS allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking (stealing the admin session cookie) and defacement. The SQL injection can result in full confidentiality and integrity compromise: unauthorized access to database contents (confidentiality) and unauthorized modification of product categories and other business data (integrity) [2]. The attacker may gain admin-level control over the application.

Mitigation

As of the publication date, no official patch has been released by the vendor and the vulnerability is listed as unpatched [2]. The recommended mitigations are to apply output escaping using htmlspecialchars() on all dynamic data rendered in the browser to prevent XSS, and to replace all raw SQL queries with parameterized statements (prepared statements) to prevent SQL injection [2]. Users should monitor the official SourceCodester project page for updates [1].