| Название | SourceCodester Online Food Ordering System 1.0 Cross Site Scripting |
|---|
| Описание | The Online Food Ordering System distributed by SourceCodester contains a stored cross-site scripting (XSS) vulnerability in its category management functionality.
The application accepts a category title through admin/add_category.php and stores it in the database. The category listing in admin/category.php subsequently renders the stored title without appropriate HTML output encoding.
During testing against a local installation, HTML markup submitted as a category title was interpreted by the browser. A test payload containing an image element with an event handler triggered JavaScript execution when the stored category was displayed.
This demonstrates stored client-side script execution in the tested environment. The potential impact depends on which users can access the affected page and their privileges. Attacks against other users, session compromise, and account takeover have not been verified.
The exact affected product release has not been independently confirmed. Testing was performed in a local lab environment. |
|---|
| Источник | ⚠️ https://gist.github.com/shamillshaanuh/f5e39643e1504536f55bf02bb51c3598 |
|---|
| Пользователь | MUHAMMED SHAMIL (UID 102105) |
|---|
| Представление | 13.10.2026 11:47 (23 дни назад) |
|---|
| Модерация | 04.11.2026 20:10 (22 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 431164 [SourceCodester Online Food Ordering System 1.0 Category Management admin/add_category.php category_title межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|