CVE-2026-112097 Details

A stored cross-site scripting vulnerability has been identified in SourceCodester Inventory System version 1.0. The issue arises in the Sales Management Handler within the file '/api/transactions_handler.php?action=save_sale'. The vulnerability is triggered by the 'Hsn_Code' parameter, allowing remote attackers to inject malicious scripts. The application fails to properly sanitize user input before saving it to the database, where it can be executed in the context of users who access the sales management page.

To address this vulnerability, input validation should be implemented to sanitize user inputs before storing them in the database. Additionally, DataTables should be configured to escape text properly, and server-side output encoding should be applied in PHP templates. Finally, the 'HttpOnly' flag should be set on session cookies to protect them from being accessed by injected scripts.