Stock Management System EUVD-2026-64624

The attack requires the target application to be network-accessible and a victim user to view a page rendered from the manipulated clientName or clientContact parameter in /php_action/printOrder.php. The CVSS 4.0 vector specifies PR:N, meaning no authentication is required to submit the malicious payload. However, UI:P (passive user interaction) is required - exploitation is contingent on a legitimate user (likely an authenticated operator or admin) loading the printOrder page. Exploitation is limited by: (1) the product's narrow deployment base (primarily academic/demo installations), (2) the need for victim interaction to trigger the script, and (3) no evidence of automated exploitation tooling beyond the disclosed proof-of-concept. Non-default or restricted network exposure (e.g., intranet-only deployment) would substantially reduce real-world risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/E:P) scores 5.3 Medium. Attack complexity is low and no privileges are required to craft a malicious payload, but passive user interaction (UI:P) is necessary - a victim must view the manipulated print order page. The scored impact is limited to low integrity (VI:L) with no confidentiality or availability impact reflected in the vendor-provided vector, which is conservative relative to typical XSS potential (session theft is plausible). The E:P supplemental metric confirms a public proof-of-concept exists. No EPSS data was provided and KEV status is negative, suggesting no observed mass exploitation. Real-world risk is substantially curtailed by the product's narrow deployment footprint - SourceCodester applications are primarily used in academic/demo environments, not production enterprise settings. Overall: low operational priority for most organizations; relevant only to those knowingly running this specific application.

An attacker crafts a URL or form submission targeting /php_action/printOrder.php with a clientName value containing a malicious script payload (e.g., an injected script tag or onerror event handler). When an authenticated staff member or administrator views the resulting print order page - for example, by processing a customer order - the script executes in their browser session, potentially exfiltrating their session cookie to an attacker-controlled server. The public proof-of-concept on GitHub lowers the technical bar for this attack to near-zero.