EUVD-2026-59783
GHSA-x4gr-3xwc-cpj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required to inject; scope changes as stored XSS executes in victim browser, enabling session token theft (C:L) and DOM manipulation (I:L).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.
AnalysisAI
Stored cross-site scripting in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the System Settings Module at /admin/index.php?page=site_settings, which subsequently executes in the browser of any user who loads the affected settings page. A public proof-of-concept has been disclosed (CVSS 4.0 E:P modifier confirmed), though the CVSS 4.0 base score of 1.9 reflects the significant constraint of requiring prior administrative access. No active exploitation has been identified in CISA KEV, and no vendor-issued patch is confirmed at time of analysis.
Technical ContextAI
The vulnerability is a stored (persistent) cross-site scripting flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), affecting a PHP-based web application. The attack surface is the System Settings Module, reachable via the admin panel route /admin/index.php?page=site_settings. Stored XSS in this class arises when user-supplied input written to a settings record is later retrieved and rendered in the browser without proper HTML output encoding or Content Security Policy controls. Because settings data is typically rendered across multiple admin sessions, the injected payload persists and fires for every privileged user who subsequently visits the page. No CPE string was supplied in the input data; the affected product is identified as SourceCodester Online Book Store System version 1.0, a PHP community/educational application distributed via sourcecodester.com.
RemediationAI
No vendor-released patch has been identified at time of analysis. As a primary compensating control, restrict access to the /admin/ directory to trusted IP addresses via server-level access control (e.g., Apache .htaccess Allow/Deny directives or nginx geo module), which eliminates remote exploitation given the PR:H requirement - the trade-off is that remote admin access is blocked for legitimate users as well. Additionally, implement strict output encoding for all fields rendered in the System Settings Module and enforce a Content Security Policy header to block inline script execution, which mitigates XSS impact even if injection is possible. Because SourceCodester applications are primarily educational reference implementations, organizations should avoid deploying them in production environments without a full secure code review. The researcher disclosure is available at https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-xss-in-system-settings-module-fa4f99ed1544 and the VulDB entry at https://vuldb.com/vuln/390097.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today