CVE-2026-5325 Details

A stored cross-site scripting vulnerability has been identified in SourceCodester Simple Customer Relationship Management System version 1.0. The issue arises in the Create Ticket feature, specifically within the file '/create-ticket.php'. User input in the Ticket Subject and Ticket Description fields is not properly sanitized before being saved to the database. This allows attackers to inject malicious JavaScript, which is executed when the ticket is viewed. The vulnerability could be exploited to execute arbitrary scripts in the context of the user, potentially leading to cookie theft, unauthorized actions on behalf of the user, phishing attacks, or content defacement.

It is recommended to sanitize user input before it is stored in the database, use proper output encoding when displaying user data, implement a strong Content Security Policy to prevent inline script execution, and validate input to reject anything containing malicious scripts.