CVE-2026-10247: XSS in SourceCodester Pharmacy Sales System 1.0

Technical summary

CVE-2026-10247 is a reflected XSS vulnerability in the /ShowForm/create_generic_name/main endpoint of SourceCodester Pharmacy Sales and Inventory System 1.0. The create_generic_name function fails to properly sanitize or encode the generic_name request parameter before rendering it in the HTTP response. This occurs after authentication (PR:L), meaning an attacker must first obtain valid credentials. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 score of 3.5 (LOW) reflects the authentication requirement and user interaction requirement, despite the network-accessible attack vector.

Business impact

If exploited against pharmacy staff, this vulnerability could enable attackers to modify medication inventory data, tamper with prescription records, or capture sensitive patient information. An attacker with a low-privilege account (e.g., a junior technician) could escalate privileges by stealing session tokens from higher-privileged users, or manipulate critical data to trigger operational disruptions. For healthcare-adjacent systems, even low-severity XSS can create compliance concerns under HIPAA or similar regulations if patient data exposure occurs.

Affected systems

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected. This is a PHP-based open-source application commonly deployed in small to mid-sized pharmacies. Organizations running this exact version should verify their deployments. The /ShowForm/create_generic_name/main endpoint is specifically vulnerable; other endpoints may have similar issues and should be audited.

Exploitability

Exploitation requires an authenticated account (PR:L), which limits the attack surface but does not eliminate it—staff credentials are often easier to obtain or compromise than administrative ones. A user interaction requirement (UI:R) means the victim must follow a malicious link or be socially engineered to click it. However, public exploit code is available, lowering the technical barrier for attackers without deep expertise. The network-accessible nature (AV:N) means no local access is required. Overall, this is exploitable in realistic scenarios but not trivially weaponized against random users.

Remediation

Apply vendor patches as soon as they are published. If patches are not available, implement input validation on the generic_name parameter to reject or strip HTML/JavaScript characters, and apply output encoding (HTML entity encoding) when rendering the parameter in responses. A Web Application Firewall (WAF) rule to block requests containing common XSS payloads (e.g., <script>, onerror=, javascript:) in the generic_name parameter can mitigate immediate risk. Consider requiring strong password policies and multi-factor authentication to reduce the likelihood of credential compromise.

Patch guidance

Verify the vendor (SourceCodester) website or official update channels for a patched version above 1.0. Patches should be applied immediately upon availability, given public exploit code. In a test environment, validate that the patch resolves the XSS issue by attempting injection of test payloads before deploying to production. Monitor the application for any behavioral changes post-patch. If the vendor ceases support for version 1.0, evaluate migrating to a maintained alternative pharmacy system.

Detection guidance

Monitor web server logs and WAF logs for requests to /ShowForm/create_generic_name/main with suspicious generic_name parameter values (e.g., containing <, >, ", ', javascript:, onerror, or onload). Alert on any logged-in user accounts making requests with XSS-like payloads. Conduct input validation testing on all form fields and URL parameters in the application. Use a SAST tool to scan the source code for instances where user input is rendered without encoding. Review browser console errors and network traffic on staff workstations for signs of injected scripts.

Why prioritize this

Despite the LOW CVSS score, this vulnerability should be prioritized because public exploit code is available and the system handles sensitive healthcare data. Authentication and user interaction requirements prevent mass exploitation, but targeted attacks against pharmacy staff are realistic. The healthcare context elevates business and regulatory risk beyond what the technical score alone suggests. Prioritize patching before wider distribution of full exploit chains occurs.

Risk score, explained

The CVSS v3.1 score of 3.5 reflects a LOW severity rating due to three limiting factors: (1) authentication is required (PR:L), (2) user interaction is necessary (UI:R), and (3) impact is limited to integrity (I:L) with no confidentiality or availability impact. However, this score does not capture the healthcare compliance implications or the fact that exploit code is public. Security teams should interpret 3.5 as a baseline; business context and threat intelligence (public exploits) justify elevated remediation urgency.

Frequently asked questions