SourceCodester Web-based Pharmacy Product Management System edit-profile.php クロスサイトスクリプティング

Successful exploitation of CVE-2026-3766 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious actions, including session hijacking, credential theft, redirection to phishing sites, and defacement of the application. Given the pharmacy context, sensitive patient data, including personal information and prescription details, could be compromised. The impact is amplified if the system is used to manage financial transactions, as attackers could potentially manipulate payment processes.

Pharmacies and healthcare providers utilizing SourceCodester Web-based Pharmacy Product Management System version 1.0 are at direct risk. Shared hosting environments where multiple pharmacy systems reside on the same server are particularly vulnerable, as a compromise of one system could potentially lead to lateral movement and impact others.

• php / web:

 grep -r 'fullname' /var/www/html/edit-profile.php | grep -i '<script' 

• generic web:

curl -I http://your-pharmacy-system/edit-profile.php?fullname=<script>alert(1)</script> | grep -i script

1. 2026-03-08Disclosure

   disclosure

1. 予約済み2026-03-07
2. 公開日2026-03-08
3. 更新日2026-03-10
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-3766 is to upgrade to a patched version of SourceCodester Web-based Pharmacy Product Management System. As no fixed version is specified, contact SourceCodester directly for an updated release. In the interim, implement strict input validation and output encoding on the fullname parameter within the edit-profile.php file. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests. Regularly review and update security policies and user access controls.