PHP EUVD-2026-17101

Victim must click a crafted URL targeting SourceCodester Sales and Inventory System 1.0's add_stock.php file with malicious payload in the 'msg' parameter. Remote unauthenticated attacker; no special configuration required.

Despite the absence of CVSS, CVE-score, and EPSS data, this vulnerability carries genuine real-world risk. The attack vector is network-based and requires no authentication, the exploit complexity is low (URL-based delivery via email or social engineering), and the technical impact includes potential session hijacking, credential theft, and malware distribution. The existence of publicly available proof-of-concept code significantly lowers the barrier to exploitation. SourceCodester products are commonly deployed in small-to-medium business environments with limited security hardening, making them attractive targets. However, reflected XSS typically requires social engineering to trick users into clicking malicious links, which slightly reduces the automated attack probability compared to stored XSS or network-layer vulnerabilities. Organizations using this product should prioritize remediation based on deployment context: if customer-facing or internet-exposed, this is high priority; if internal-only, medium priority.

An attacker crafts a malicious URL containing JavaScript code in the 'msg' parameter (e.g., add_stock.php?msg=<script>steal_session()</script>) and sends it to a victim user via email or social media. When the victim clicks the link while logged into the Sales and Inventory System, the unescaped JavaScript executes in their browser, potentially stealing session cookies, capturing login credentials, or redirecting them to a phishing site. Publicly available proof-of-concept code reduces the technical barrier, making this exploitable by attackers with basic web knowledge.