search

amirsanni / Mini-Inventory-and-Sales-Management-System

An Inventory and Sales Management System written in PHP (codeIgniter) with support for MySQL and Sqlite3 databases
https://1410inc.xyz/mini-inventory-and-sales-management-system/
MIT License
500 stars 268 forks source link

Possible XSS vulnerabilies #92

Open enferas opened 1 year ago

enferas commented 1 year ago

Hello,

I would like to report for multiple XSS vulnerabilities.

For example,

In file Mini-Inventory-and-Sales-Management-System-master\application\views\email\memberupdate.php

<p>Hi <?=$this->input->post('title')." ".$this->input->post('firstName')?>,<br>
<td><?=$this->input->post('title') ? $this->input->post('title') : "---"?></td>
<?=$this->input->post('firstName')." ".$this->input->post('lastName')." ".$this->input->post('otherName')?>
<?=$this->input->post('mobile1') . ($this->input->post('mobile2') ? ", ".$this->input->post('mobile2') : "")?>
<td><?=$this->input->post('membershipId')?></td>
<td><?=$this->input->post('gender')?></td>
<td><?=$this->input->post('address')?></td>
<td><?=$this->input->post('city')?></td>
<td><?=$this->input->post('state')?></td>
<td><?=$this->input->post('country')?></td>