SourceCodester Inventory System vulnerabilities

A vulnerability was found in SourceCodester Inventory System 1.0 in unknown processing of /api/transactions_handler.php?action=save_sale within the sales management handler component. Manipulating the Hsn_Code argument results in cross-site scripting (XSS), and the attack can be launched remotely.

A vulnerability was found in SourceCodester Inventory System 1.0 in the file /api/transactions_handler.php (action save_purchase) of the Purchase Records Handler. Manipulation of the Product_Name, Product_Code or Vendor_Name arguments leads to cross-site scripting. The attack can be performed remotely and the exploit has been publicly disclosed.

A flaw was found in SourceCodester Inventory System 1.0 in the file /api/products_handler.php (action save) of the Product Management component. Manipulation of the Product_Id or Product_Name arguments can lead to cross-site scripting. The attack can be performed remotely and the exploit has been published.

A cross-site scripting vulnerability was found in SourceCodester Inventory System 1.0 in the header.php file. Manipulation of unknown functionality allows remote attack. The exploit is publicly available.

A vulnerability in SourceCodester Inventory System 1.0 in the file /Product_Inventory/api/users_handler.php of the Account Creation Handler component allows manipulation of the ROLE argument, leading to improper authorization and remote attack.

SourceCodester Inventory System 1.0 has a cross-site scripting (XSS) vulnerability in /users.php (User Management Page) via the fullname and username parameters. The attack is remotely exploitable and the exploit is publicly available.