CVE-2026-10247: Pharmacy Sales Inventory System XSS Flaw

CVE-2026-10247 Overview

CVE-2026-10247 is a cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw resides in the create_generic_name function within /ShowForm/create_generic_name/main. Attackers can inject malicious script content through the generic_name parameter, which the application reflects back without proper sanitization. The issue is classified under [CWE-79] and can be exploited remotely over the network with low privileges and user interaction. Public exploit details are available, increasing the risk of opportunistic abuse against exposed instances.

Critical Impact
Authenticated remote attackers can inject arbitrary JavaScript through the generic_name parameter, enabling session theft, UI manipulation, and phishing against legitimate users of the pharmacy management application.

Affected Products

SourceCodester Pharmacy Sales and Inventory System 1.0
Component: create_generic_name function
Endpoint: /ShowForm/create_generic_name/main

Discovery Timeline

2026-06-01 - CVE-2026-10247 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10247

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the pharmacy management web application. The create_generic_name function accepts user-supplied input through the generic_name argument and renders it back into the application response without performing HTML encoding or input validation. When a victim loads the affected page, the injected payload executes within the browser context of the application.

Exploitation requires authenticated access with low privileges and at least one user interaction, such as visiting a crafted link or viewing an injected record. Successful exploitation lets attackers hijack sessions, perform actions on behalf of authenticated pharmacy staff, or pivot toward credential theft against administrators.

Root Cause

The root cause is missing output encoding and inadequate input validation on the generic_name parameter handled by create_generic_name. The application treats user input as trusted markup when rendering form data. Without contextual escaping for HTML, attribute, or JavaScript contexts, any <script> payload or event handler injected through generic_name is interpreted by the browser.

Attack Vector

The attack is network accessible and requires the attacker to hold a valid low-privilege account in the application. The attacker submits a crafted generic_name value containing JavaScript through the create form, then induces another authenticated user to view the affected page. The injected script executes under the victim's session, exposing cookies, CSRF tokens, and DOM contents. Public proof-of-concept information is referenced in the GitHub Issue Tracker and the VulDB CVE Entry.

The vulnerability manifests in the form submission handler for generic name creation. See the referenced advisory for payload specifics.

Detection Methods for CVE-2026-10247

Indicators of Compromise

HTTP POST requests to /ShowForm/create_generic_name/main containing <script>, onerror=, onload=, or javascript: tokens in the generic_name parameter.
Database records under the generic name field containing raw HTML or JavaScript markup.
Outbound browser requests from staff workstations to unfamiliar domains shortly after accessing pharmacy inventory pages.

Detection Strategies

Inspect web server access logs for unusual character sequences such as %3Cscript%3E, %3Cimg, or onerror in requests targeting create_generic_name.
Deploy a web application firewall (WAF) rule set that flags HTML and JavaScript metacharacters submitted to pharmacy form endpoints.
Review stored generic name entries in the application database for content that does not match expected pharmaceutical naming conventions.

Monitoring Recommendations

Enable verbose application logging for all create, update, and view operations on generic_name records.
Monitor authenticated user sessions for anomalous activity such as unexpected privilege use, simultaneous logins, or rapid record creation.
Alert on Content Security Policy (CSP) violation reports if CSP is configured in report-only mode.

How to Mitigate CVE-2026-10247

Immediate Actions Required

Restrict access to the Pharmacy Sales and Inventory System to trusted internal networks until a patched build is available.
Audit existing generic_name records and remove or sanitize any entries containing HTML or JavaScript markup.
Rotate session secrets and force re-authentication for all users who may have viewed tampered records.

Patch Information

No official vendor patch is currently referenced for SourceCodester Pharmacy Sales and Inventory System 1.0. Administrators should monitor the SourceCodester Security Resource and the GitHub Issue Tracker for updates. Until a fix is released, apply the workarounds below and consider source-level changes to the create_generic_name handler.

Workarounds

Apply server-side input validation that rejects any generic_name value containing <, >, ", ', or & characters before storage.
Implement contextual output encoding using a templating engine that auto-escapes HTML when rendering generic name fields.
Deploy a Content Security Policy header that disallows inline scripts and restricts script sources to trusted origins.
Place a WAF in front of the application with rules blocking common XSS payload patterns on form submission endpoints.

bash

# Example nginx CSP header to mitigate XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;