EUVD-2026-43278
GHSA-m89g-6gv4-875j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required to inject (PR:H); stored XSS executes in victim's browser scope (S:C, UI:R); low C and I reflect session/content impact with no server-side confidentiality or availability loss.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Module. Such manipulation of the argument Name/Username leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used.
AnalysisAI
Stored cross-site scripting (XSS) in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious script payloads via the Name or Username fields in the User Management Module, which then execute in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists, documented in a Medium article specifically demonstrating authenticated stored XSS in this module. This is not confirmed in the CISA KEV catalog, and real-world impact is constrained by the niche, educational nature of the affected software and the requirement for administrative credentials to inject payloads.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input in the Name and Username fields of the User Management Module is not adequately sanitized or encoded before being persisted and subsequently rendered in HTML responses. This results in stored (persistent) XSS, where the injected payload is saved server-side and executes in the browser of any user loading the affected page - distinct from reflected XSS, which requires the victim to click a crafted link. The affected product is identified by CPE cpe:2.3:a:sourcecodester:online_book_store_system:*:*:*:*:*:*:*:* at version 1.0, a PHP-based web application distributed by SourceCodester as an educational or demo project. No framework-level output encoding or Content Security Policy protections appear to be in place for the affected input paths.
RemediationAI
No vendor-released patch or security advisory has been identified for SourceCodester Online Book Store System 1.0 at the time of this analysis - the references link only to VulDB reports and the product's homepage, not to any official fix. Upstream fix availability per a GitHub PR or commit has not been confirmed. Operators of this software should immediately apply output encoding (e.g., htmlspecialchars() in PHP) to all Name and Username fields rendered in HTML within the User Management Module, and validate/sanitize input on write. As a compensating control, restrict access to the User Management Module to the minimum number of trusted administrators, reducing the pool of accounts that could be used to inject payloads. Implementing a Content Security Policy (CSP) header that disallows inline scripts would significantly reduce the impact of any stored XSS payloads. Given the educational nature of the software, deploying it in internet-exposed production environments is strongly discouraged.
More in Online Book Store System
View allSQL injection in SourceCodester Online Book Store System 1.0 exposes the admin authentication panel to remote, unauthent
Local File Inclusion (LFI) in SourceCodester Online Book Store System 1.0 allows authenticated remote attackers to read
Unrestricted file upload in SourceCodester Online Book Store System 1.0 allows authenticated remote attackers with admin
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today