| 제목 | SourceCodester Online Food Ordering System 1.0 Cross Site Scripting |
|---|
| 설명 | The Online Food Ordering System distributed by SourceCodester contains a stored cross-site scripting (XSS) vulnerability in its category management functionality.
The application accepts a category title through admin/add_category.php and stores it in the database. The category listing in admin/category.php subsequently renders the stored title without appropriate HTML output encoding.
During testing against a local installation, HTML markup submitted as a category title was interpreted by the browser. A test payload containing an image element with an event handler triggered JavaScript execution when the stored category was displayed.
This demonstrates stored client-side script execution in the tested environment. The potential impact depends on which users can access the affected page and their privileges. Attacks against other users, session compromise, and account takeover have not been verified.
The exact affected product release has not been independently confirmed. Testing was performed in a local lab environment. |
|---|
| 원천 | ⚠️ https://gist.github.com/shamillshaanuh/f5e39643e1504536f55bf02bb51c3598 |
|---|
| 사용자 | MUHAMMED SHAMIL (UID 102105) |
|---|
| 제출 | 2026. 10. 13. AM 11:47 (23 날 ago) |
|---|
| 모더레이션 | 2026. 11. 04. PM 08:10 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 431164 [SourceCodester Online Food Ordering System 1.0 Category Management admin/add_category.php category_title 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|