SourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scripting

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Indian Invoicing System version 0.x and 1.0. The flaw resides in the /Invoicing/add_order.php endpoint, specifically in how the customer_name argument is processed. User-supplied input is stored in the database and later rendered without proper output encoding in invoice templates, such as /Invoice.php and /IGST_Invoice.php. This allows an attacker to inject arbitrary JavaScript code that will execute when the invoice page is viewed.

Exploitation

An attacker needs no special privileges beyond the ability to make a POST request to the vulnerable endpoint. The attack can be launched remotely. The exploit involves sending a crafted request with a JavaScript payload in the customer_name field, as demonstrated in available references [1][2]. For example, the payload "> is URL-encoded and submitted via HTTP POST. The application stores this payload in the database, and when any user (including administrators) views the invoice via /Invoice.php or /IGST_Invoice.php, the malicious script executes in their browser. The PoC has been publicly released.

Impact

Successful exploitation leads to client-side execution of arbitrary JavaScript in the context of the victim's session. This can result in session hijacking, defacement, redirection to malicious sites, or theft of sensitive information displayed on the invoice page. The attack targets authenticated users who view the affected invoices, potentially compromising their account and data within the invoicing system.

Mitigation

As of the publication date, no official patch has been released for the SourceCodester Indian Invoicing System. The vendor has not acknowledged a fix, and the vulnerability remains unpatched. Mitigation recommendations include: escaping all dynamic values before rendering HTML, sanitizing and validating invoice-related fields at input time, and auditing all invoice and PDF views for unsafe data reflections. Organizations using this software should consider implementing a web application firewall or modifying the source code to apply proper output encoding.