Stock Management System CVE-2026-78060

The attack is triggered when a victim user or administrator views an order report generated from attacker-controlled input in the clientName or clientContact fields of /php_action/getOrderReport.php. The attacker requires no authentication (PR:N in CVSS 4.0) and no special system access - only the ability to submit HTTP requests to the endpoint. Passive user interaction (UI:P) is required: a victim must render the resulting report page in a browser for the injected script to execute. Exploitation is constrained by whether the report-viewing action is performed by a privileged user (e.g., an administrator whose session token, if stolen, would grant further access). The application must be network-accessible; a deployment restricted to localhost or an internal VLAN materially limits exposure.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:P) characterizes this as a low-complexity, network-reachable flaw requiring only passive victim interaction - a typical reflected or context-injected XSS profile. The E:P (exploit public) supplemental metric meaningfully raises practical risk beyond the 5.3 base score alone. Impact is bounded: VI:L with VC:N and no availability impact, suggesting the realistic outcome is session hijacking, credential theft via phishing overlays, or defacement rather than full system compromise. No EPSS score was provided; active exploitation is not confirmed by CISA KEV. The combination of public PoC, unauthenticated network access, and a PHP application likely deployed without a WAF means even a small team operating an internet-exposed instance should treat remediation as a near-term priority rather than a deferred task. The absence of CISA KEV listing and the limited scope of the affected product constrain the aggregate threat surface.

An attacker submits a crafted HTTP request to /php_action/getOrderReport.php with a JavaScript payload embedded in the clientName or clientContact parameter - for example, a script tag that exfiltrates document cookies to an attacker-controlled server. When a logged-in administrator or staff member views the resulting order report, the browser executes the injected script, potentially surrendering their session token. A public PoC for this exact mechanism is referenced at https://github.com/i-QvQ-i/first-OvO/issues/13, meaning the exploit is ready to use without adaptation.