| Title | SourceCodester Online Food Ordering System 1.0 Cross Site Scripting |
|---|
| Description | The Online Food Ordering System distributed by SourceCodester contains a stored cross-site scripting (XSS) vulnerability in its category management functionality.
The application accepts a category title through admin/add_category.php and stores it in the database. The category listing in admin/category.php subsequently renders the stored title without appropriate HTML output encoding.
During testing against a local installation, HTML markup submitted as a category title was interpreted by the browser. A test payload containing an image element with an event handler triggered JavaScript execution when the stored category was displayed.
This demonstrates stored client-side script execution in the tested environment. The potential impact depends on which users can access the affected page and their privileges. Attacks against other users, session compromise, and account takeover have not been verified.
The exact affected product release has not been independently confirmed. Testing was performed in a local lab environment. |
|---|
| Source | ⚠️ https://gist.github.com/shamillshaanuh/f5e39643e1504536f55bf02bb51c3598 |
|---|
| User | MUHAMMED SHAMIL (UID 102105) |
|---|
| Submission | 10/13/2026 11:47 (22 days ago) |
|---|
| Moderation | 11/04/2026 20:10 (22 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 431164 [SourceCodester Online Food Ordering System 1.0 Category Management admin/add_category.php category_title cross site scripting] |
|---|
| Points | 20 |
|---|