CVE-2026-8136: Pharmacy Sales & Inventory System XSS Flaw

CVE-2026-8136 Overview

CVE-2026-8136 is a cross-site scripting (XSS) vulnerability affecting SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw resides in the /index.php?page=users endpoint, where the Name parameter is rendered without proper output encoding. An authenticated attacker with high privileges can inject script payloads that execute in the browsers of other users viewing the affected page. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). A public exploit has been disclosed, increasing the risk of opportunistic abuse against exposed deployments.

Critical Impact

Remote attackers with valid administrative credentials can inject persistent script payloads into the user management page, enabling session theft, credential harvesting, and unauthorized actions against other authenticated users.

Affected Products

• SourceCodester Pharmacy Sales and Inventory System 1.0
• The vulnerable component is /index.php?page=users
• The vulnerable parameter is Name

Discovery Timeline

• 2026-05-08 - CVE-2026-8136 published to the National Vulnerability Database (NVD)
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-8136

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the user management workflow of the Pharmacy Sales and Inventory System. When user data is submitted through the Name argument in requests to /index.php?page=users, the application fails to sanitize or contextually encode the input before rendering it back into the HTML response. As a result, attacker-controlled markup is interpreted by the browser as executable script.

Because the attack targets the user administration interface, payloads stored by an attacker can fire when administrators or other privileged operators view the affected listings. This can lead to session token theft, forced administrative actions through CSRF-style techniques, or pivoting to additional application areas.

Root Cause

The root cause is missing output encoding on user-supplied data rendered into HTML context. The application accepts the Name value and reflects it directly into the page without applying functions such as htmlspecialchars() with the ENT_QUOTES flag. The absence of a Content Security Policy (CSP) compounds the issue by allowing inline script execution.

Attack Vector

Exploitation requires network access to the application and an authenticated session with privileges to submit the Name field. The attacker crafts a request to /index.php?page=users containing a script payload in the Name argument. User interaction is required for the payload to fire, typically when another user loads the affected user listing or detail view. A public proof-of-concept has been referenced in the GitHub CVE Issue Tracker and VulDB Vulnerability #361925.

No verified exploit code is reproduced here. Refer to the linked advisories for technical artifacts.

Detection Methods for CVE-2026-8136

Indicators of Compromise

• HTTP POST or GET requests to /index.php?page=users containing <script>, onerror=, onload=, or javascript: sequences in the Name parameter.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing user management pages.
• New or modified user records where the Name field contains HTML tags or encoded script fragments.

Detection Strategies

• Inspect web server access logs for suspicious URL-encoded payloads (%3Cscript%3E, %22%3E%3C) targeting the page=users endpoint.
• Deploy web application firewall (WAF) signatures that flag HTML and JavaScript metacharacters submitted to the Name parameter.
• Review database tables holding user records for stored markup that does not match expected name formats.

Monitoring Recommendations

• Enable verbose request logging for the /index.php handler and forward logs to a centralized analytics platform for correlation.
• Alert on administrative sessions originating from atypical user agents or IP ranges following access to user management pages.
• Track failed integrity checks on user records and flag entries containing non-alphanumeric characters in name fields.

How to Mitigate CVE-2026-8136

Immediate Actions Required

• Restrict access to /index.php?page=users to trusted administrative networks using IP allow lists or VPN gating.
• Audit all existing user records for injected HTML or script content and sanitize affected entries.
• Rotate session cookies and administrative credentials if exploitation is suspected, since stored payloads can hijack active sessions.

Patch Information

No official vendor patch has been published in the references reviewed. Operators should monitor the SourceCodester site and the VulDB entry for #361925 for fix availability. Until a vendor patch is released, apply the workarounds below.

Workarounds

• Apply server-side output encoding by wrapping the Name field in htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before rendering.
• Enforce input validation that rejects characters outside the expected name character set, such as <, >, ", ', and /.
• Deploy a Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins.
• Place the application behind a WAF with XSS rule sets enabled to block common payloads in the Name parameter.

# Example NGINX configuration to add a restrictive CSP header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;