CVE-2023-24192 in Online Food Ordering System
Summary
by MITRE • 02/06/2023
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/30/2026
The vulnerability identified as CVE-2023-24192 represents a critical cross-site scripting weakness within the Online Food Ordering System v2 application. This flaw specifically manifests through improper input validation in the redirect parameter handling mechanism within the login.php file. The system fails to adequately sanitize user-supplied input before processing redirect requests, creating an exploitable condition that allows malicious actors to inject arbitrary script code into the application's response. This vulnerability resides in the application's authentication flow where the redirect parameter is used to determine where users should be sent after successful login, making it a prime target for attackers seeking to compromise user sessions or redirect victims to malicious sites.
The technical exploitation of this XSS vulnerability follows established patterns outlined in CWE-79, which categorizes cross-site scripting as a code injection flaw where untrusted data is embedded into web pages viewed by other users. The vulnerability specifically demonstrates characteristics of reflected XSS attacks where malicious scripts are reflected off the web server and executed in the victim's browser. Attackers can craft malicious URLs containing script payloads in the redirect parameter, which when processed by the vulnerable login.php script, get executed in the context of the victim's browser session. This creates a persistent threat vector that can be leveraged for session hijacking, credential theft, or redirection to phishing sites that appear legitimate to users.
The operational impact of this vulnerability extends beyond simple script execution, as it fundamentally compromises the integrity of user authentication flows within the food ordering system. Users who authenticate through the vulnerable application become susceptible to session manipulation attacks that can lead to unauthorized access to their accounts, potentially exposing personal information, order history, and payment details. The attack surface is particularly concerning given that this vulnerability affects the core authentication mechanism, meaning any user who successfully navigates to the vulnerable login page could be compromised. Security professionals should note that this vulnerability aligns with ATT&CK technique T1531 which involves creating or modifying system process to gain persistence, as attackers can leverage XSS to establish malicious redirects that persist across user sessions.
Mitigation strategies for CVE-2023-24192 must focus on implementing robust input validation and output encoding mechanisms throughout the application's processing pipeline. The most effective remediation involves sanitizing all user-supplied input, particularly parameters used in redirect operations, by implementing strict validation that only accepts predetermined, safe redirect destinations. Developers should implement a whitelist approach for redirect parameters, ensuring that any redirect URL must match a pre-approved list of legitimate domains or paths. Additionally, the application should employ proper output encoding when rendering user-supplied content, particularly in contexts where the redirect parameter is displayed or processed. Security headers including Content Security Policy should be implemented to prevent unauthorized script execution and limit the attack surface. Organizations should also conduct regular security assessments and implement automated input validation checks to prevent similar vulnerabilities from emerging in future versions of the application, following security best practices outlined in OWASP Top Ten and NIST Cybersecurity Framework guidelines.