A flaw exists in the Customer function of the index.php page of SourceCodester Pharmacy Sales and Inventory System 1.0. By injecting malicious code into the Name argument, an attacker can trigger an XSS payload that runs in the context of the victim’s browser. This allows the attacker to steal authentication cookies, hijack user sessions, or load additional malware. The vulnerability does not provide direct access to the underlying server logic, but it gives an attacker the ability to manipulate the browser environment of legitimate users.

SourceCodester Pharmacy Sales and Inventory System version 1.0 is affected. The vulnerability resides in the Customer function accessed via /index.php?page=customer.

The CVSS score of 5.1 classifies the flaw as moderate; the EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely by sending a crafted request containing a malicious Name parameter. Because the exploit is publicly available, networks that host the application should expect attempts to inject the payload and attempt to steal user credentials or deface the site.