CVE-2025-65215: Unveiling an XSS Vulnerability in Sourcecodester Pharmacy System

Overview

This article details CVE-2025-65215, a Cross-Site Scripting (XSS) vulnerability found in Sourcecodester Web-based Pharmacy Product Management System version 1.0. This vulnerability allows an attacker to inject malicious scripts into the application, potentially compromising user accounts, data, and the overall security of the system.

Technical Details

The vulnerability resides in the /product_expiry/add-supplier.php file within the application. Specifically, the Supplier Name field is susceptible to reflected XSS. An attacker can inject malicious JavaScript code into this field, which will then be executed in the browser of anyone who views the page after the malicious data is submitted. The lack of proper input sanitization and output encoding allows for successful exploitation.

Affected Component: Supplier Name field in /product_expiry/add-supplier.php

Vulnerability Type: Reflected Cross-Site Scripting (XSS)

CVSS Analysis

Currently, the CVSS score for CVE-2025-65215 is N/A, indicating that the severity hasn’t been formally assessed at the time of this writing. However, based on the nature of XSS vulnerabilities, it’s likely to be rated as medium to high severity depending on the potential impact and exploitability in a real-world scenario.

Possible Impact

Successful exploitation of this XSS vulnerability can have several severe consequences:

• Account Takeover: An attacker could potentially steal user session cookies and gain unauthorized access to user accounts, including administrator accounts.
• Data Theft: Sensitive data, such as customer information, product details, and financial records, could be stolen.
• Malware Distribution: The attacker could inject malicious scripts to redirect users to phishing sites or distribute malware.
• Defacement: The attacker could modify the appearance of the website, defacing it and damaging the organization’s reputation.

Mitigation and Patch Steps

To mitigate this vulnerability, the following steps are recommended:

• Input Sanitization: Implement strict input sanitization on the Supplier Name field in /product_expiry/add-supplier.php to remove or encode any potentially malicious characters before storing the data.
• Output Encoding: Ensure proper output encoding when displaying the Supplier Name field to prevent the browser from interpreting the data as executable code. Use context-aware encoding appropriate for the location where the data is displayed (e.g., HTML encoding, JavaScript encoding, URL encoding).
• Web Application Firewall (WAF): Deploy a Web Application Firewall (WAF) to detect and block XSS attacks.
• Software Update: Check for any available updates or patches from Sourcecodester. If a patch is available, apply it immediately. If not, contact the vendor for assistance.
• User Awareness Training: Educate users about the risks of XSS attacks and how to identify suspicious links or content.

References

GitHub – CVE-2025-65215 Research
LinkedIn – Vabna Lina

Published: 2025-12-02T18:15:49.113