CVE-2025-65215
📋 TL;DR
This CVE describes a stored cross-site scripting (XSS) vulnerability in the Sourcecodester Web-based Pharmacy Product Management System v1.0. Attackers can inject malicious scripts via the Supplier Name field in the product expiry module, which executes when other users view the supplier data. Organizations using this specific software version are affected.
💻 Affected Systems
- Sourcecodester Web-based Pharmacy Product Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, hijack accounts, deface the application, or redirect users to malicious sites, potentially leading to complete system compromise.
Likely Case
Attackers inject malicious scripts to steal session cookies or credentials from authenticated users, enabling unauthorized access to the pharmacy management system.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be neutralized, preventing any client-side execution.
🎯 Exploit Status
Exploitation requires access to the supplier management functionality, typically requiring authentication. The vulnerability is simple to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply following vendor instructions. 3. Test functionality after patching.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and HTML encoding for the Supplier Name field
Modify /product_expiry/add-supplier.php to sanitize input using htmlspecialchars() or similar functions
Content Security Policy
allImplement CSP headers to restrict script execution
Add header: Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in the Supplier Name parameter
- Restrict access to the /product_expiry/ directory to authorized users only and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Test by entering <script>alert('XSS')</script> in the Supplier Name field and check if script executes when viewing suppliersCheck Version:
Check the software version in the admin panel or readme filesVerify Fix Applied:
Test the same payload after implementing fixes - script should not execute and should appear as plain text📡 Detection & Monitoring
Log Indicators:
- Unusual supplier names containing script tags or JavaScript code
- Multiple failed login attempts followed by supplier creation
Network Indicators:
- HTTP requests to /product_expiry/add-supplier.php with script tags in parameters
- Outbound connections to suspicious domains from the application
SIEM Query:
source="web_server" AND uri="/product_expiry/add-supplier.php" AND (param="supplier_name" AND value MATCHES "<script.*>.*</script>")