CVE-2026-122190 in Online Food Ordering System
Summary
by MITRE • 11/05/2026
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The SourceCodester Online Food Ordering System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the Category Management component found at admin/add_category.php. This vulnerability manifests as an Unrestricted Upload of Web-Shell or Stored Cross-Site Scripting depending on implementation details, but based on the provided description focusing on manipulation of the category_title argument resulting in cross-site scripting, it is classified primarily as a Stored XSS vulnerability. The core technical flaw stems from insufficient input validation and sanitization mechanisms when processing user-supplied data for the category title field. When an administrator or attacker inputs malicious script code into this parameter, the system fails to escape special characters such as quotes, ampersands, angle brackets, or JavaScript event handlers before storing the value in the backend database or rendering it directly back to the client side without proper encoding. This lack of robust output encoding allows arbitrary JavaScript payloads to be embedded within the application's response pages.
From an operational perspective, this vulnerability poses a severe risk because it is remotely exploitable and has been publicly disclosed with available proof-of-concept exploits. An attacker can initiate attacks from any remote location by crafting HTTP requests that inject malicious scripts into the category title field during the creation or modification of food categories. Once stored, these scripts are executed every time an authorized user views the affected page in their web browser. This persistent nature distinguishes it from reflected XSS and significantly increases its impact potential. The attacker can steal session cookies, hijack administrative sessions, perform actions on behalf of the victim such as adding malicious menu items or altering system configurations, deface the website interface, or redirect users to phishing sites designed to harvest credentials for other services where the user might be authenticated via single sign-on mechanisms.
The vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it represents a Stored XSS scenario where malicious content is saved on the target server and subsequently served to other users. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques related to Collection via Browser Hijacking or Credential Access through Browser Session Theft. The ability to execute arbitrary scripts in the context of the administrative panel elevates the severity significantly compared to standard user-facing pages because it compromises the integrity and confidentiality of the management interface itself.
Mitigation strategies must focus on implementing strict input validation and output encoding practices within the application codebase. Developers should enforce a whitelist approach for allowed characters in the category_title field, rejecting any input containing HTML tags or script-related symbols unless explicitly required by a rich text editor with proper sanitization libraries like OWASP Java Encoder or equivalent PHP functions such as htmlspecialchars with appropriate flags. Furthermore, implementing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to load and execute. Regular security audits and static code analysis tools should be employed to detect similar patterns in other parts of the application that handle user input before storage or display. Updating to a patched version if available is the most effective immediate remediation, while temporary workarounds include disabling direct HTML rendering for category titles until the underlying code defect is resolved.