CVE-2026-10244: Pharmacy Sales System XSS Vulnerability

CVE-2026-10244 Overview

CVE-2026-10244 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw resides in the create_medicine_name function within the /ShowForm/create_medicine_name/main endpoint. Attackers can manipulate the medicine_name parameter to inject arbitrary script content, which is then rendered in the browser of any user viewing the affected page.

The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). It can be triggered remotely over the network, and public exploit details are already available through VulDB and GitHub.

Critical Impact
An authenticated remote attacker can inject JavaScript into the application, potentially hijacking sessions, stealing credentials, or performing actions on behalf of other users within the pharmacy management interface.

Affected Products

SourceCodester Pharmacy Sales and Inventory System 1.0
Component: create_medicine_name function
Endpoint: /ShowForm/create_medicine_name/main

Discovery Timeline

2026-06-01 - CVE CVE-2026-10244 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10244

Vulnerability Analysis

The vulnerability exists in the create_medicine_name handler exposed at /ShowForm/create_medicine_name/main. The application accepts the medicine_name argument from user input and reflects it into the rendered HTML response without proper output encoding or input sanitization.

An attacker supplies a crafted medicine_name value containing HTML or JavaScript markup. When the response is processed by the victim's browser, the injected payload executes in the context of the application's origin. This grants the attacker access to cookies, session tokens, and DOM contents accessible to the page.

Exploitation requires low-level privileges and user interaction, consistent with stored or reflected XSS scenarios where a victim must visit a crafted URL or page. The CWE classification ([CWE-79]) confirms the root mechanism: improper neutralization of input during web page generation.

Root Cause

The application fails to apply contextual output encoding when rendering the medicine_name field back to the response. There is no allowlist-based input validation or HTML entity escaping applied before the data reaches the template. As a result, characters such as <, >, and " flow through untouched and are interpreted as markup by the browser.

Attack Vector

The attack is initiated remotely over HTTP. An attacker crafts a request to /ShowForm/create_medicine_name/main with a JavaScript payload embedded in the medicine_name parameter. The payload may be delivered through a phishing link or embedded in a page that an authenticated pharmacy operator visits. Once rendered, the script runs with the privileges of the targeted user account within the inventory system.

For technical specifics, refer to the GitHub CVE Issue Discussion and the VulDB entry for CVE-2026-10244.

Detection Methods for CVE-2026-10244

Indicators of Compromise

HTTP requests targeting /ShowForm/create_medicine_name/main containing <script>, onerror=, onload=, or encoded variants in the medicine_name parameter.
Web server access logs showing unusually long or URL-encoded medicine_name values.
Outbound browser requests from operator workstations to attacker-controlled domains shortly after accessing the form.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the medicine_name parameter for HTML control characters and common XSS signatures.
Implement server-side logging of all input submitted to the create_medicine_name endpoint for retroactive analysis.
Correlate authentication anomalies, such as unexpected session reuse or geographic mismatches, with form submissions to the vulnerable endpoint.

Monitoring Recommendations

Monitor browser Content Security Policy (CSP) violation reports for blocked inline script executions.
Alert on access log entries containing URL-encoded angle brackets (%3C, %3E) in request bodies or query strings.
Track repeated form submissions from a single source IP within short time windows.

How to Mitigate CVE-2026-10244

Immediate Actions Required

Restrict access to the Pharmacy Sales and Inventory System to trusted internal networks until a patched version is available.
Apply input validation rules at a reverse proxy or WAF to strip or reject HTML metacharacters in the medicine_name field.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources.

Patch Information

No official vendor patch is currently referenced in the advisory. SourceCodester users should monitor the SourceCodester project page and the VulDB vulnerability record for updates. Until a fix is published, organizations must rely on compensating controls.

Workarounds

Modify the application source to HTML-encode the medicine_name value before rendering, using context-appropriate escaping for HTML body, attribute, and JavaScript contexts.
Add server-side validation to reject any medicine_name input containing <, >, \", ', or / characters.
Configure session cookies with HttpOnly and SameSite=Strict flags to limit the impact of script execution.
Require multi-factor authentication for administrative accounts that interact with the affected form.

bash

# Example NGINX rule to block suspicious medicine_name payloads
location /ShowForm/create_medicine_name/ {
    if ($arg_medicine_name ~* "(<|>|script|onerror|onload|%3C|%3E)") {
        return 403;
    }
    proxy_pass http://backend;
}