SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting

The XSS vulnerability in Simple Customer Relationship Management System allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a user's browser when they visit the affected page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or deface the website. The impact is amplified if the application is used to store sensitive customer data, as an attacker could potentially access or modify this information. The publicly disclosed nature of this vulnerability increases the risk of exploitation.

Organizations using Simple Customer Relationship Management System version 1.0, particularly those with publicly accessible instances or those handling sensitive customer data, are at risk. Shared hosting environments where multiple users share the same server are also at increased risk, as a compromised account could be used to exploit the vulnerability and impact other users.

• php / web:

curl -I 'http://your-target/create-ticket.php?Description=<script>alert("XSS")</script>' | grep -i 'X-Powered-By'

• generic web:

curl -s 'http://your-target/create-ticket.php?Description=<script>alert("XSS")</script>' | grep 'alert("XSS")'

1. 2026-04-02Disclosure

   disclosure

1. Reserviert2026-04-01
2. Veröffentlicht2026-04-02
3. EPSS aktualisiert2026-04-09

Due to the lack of a provided fixed version, immediate mitigation strategies are crucial. Implement strict input validation and output encoding on the Description field in /create-ticket.php to prevent the injection of malicious scripts. Consider using a Web Application Firewall (WAF) with XSS protection rules to filter out potentially harmful requests. Regularly scan the application for XSS vulnerabilities using automated tools. After implementing these mitigations, thoroughly test the /create-ticket.php functionality to ensure that input validation is effective and does not break legitimate use cases.