| Title | SourceCodester Online Food Ordering System 1.0 Stored XSS via Unrestricted File Upload |
|---|
| Description | Stored Cross-Site Scripting (Stored XSS) via SVG Image Upload in Category Update — Online Food Ordering System
Vulnerability Information
Project: Online Food Ordering System
Vendor: SourceCodester
Vendor Website: https://www.sourcecodester.com
Version: 1.0
Vulnerability Type: Stored Cross-Site Scripting (Stored XSS)
Test Environment
Operating System: Windows 11
Description
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Online Food Ordering System v1.0 within the Category Update functionality.
An authenticated administrator can upload an SVG image containing malicious JavaScript when updating a category. The application accepts the SVG file without properly sanitizing or validating its contents. After the image is uploaded, the uploaded SVG can be accessed directly, resulting in JavaScript execution within the application's origin.
Because the malicious SVG is stored on the server, the vulnerability is persistent and can affect users who access the uploaded resource.
Steps to Reproduce
1. Login to the application using an Admin account.
2. Navigate to Categories.
3. Select a category and choose Update/Edit.
4. Under the image upload functionality, click Add New Image / browse for an image.
5. Select a malicious SVG file such as XSS.svg.
6. Upload the SVG file.
7. After the upload completes, right-click the uploaded image/resource and select Open/Access Image.
8. The uploaded SVG is loaded directly by the browser.
9. Observe that the JavaScript embedded within the SVG executes successfully.
Proof of Concept
Example malicious SVG payload:
<svg xmlns="http://www.w3.org/2000/svg">
<script>
alert(document.domain);
</script>
</svg>
Observed Result
The application accepts and stores the malicious SVG file. When the uploaded SVG is directly accessed, the embedded JavaScript executes successfully, demonstrating Stored Cross-Site Scripting.
Impact
Successful exploitation may allow an attacker with access to the vulnerable image-upload functionality to execute arbitrary JavaScript in the context of the application.
Potential impacts include:
• Execution of arbitrary client-side JavaScript
• Unauthorized actions performed in an authenticated user's context
• Credential or phishing attacks
• DOM manipulation
• Client-side redirection
• Defacement of application content
• Potential access to sensitive browser-accessible information, depending on application security controls
Root Cause
The vulnerability occurs because SVG files are accepted as image uploads without adequately validating or sanitizing their XML content.
SVG is an active XML-based image format that can contain scripting elements and event handlers. Treating uploaded SVG files as trusted static images can therefore result in JavaScript execution when the file is rendered directly by a browser.
Recommended Mitigation
• Restrict image uploads to safe raster formats such as PNG, JPG/JPEG, and WEBP where possible.
• If SVG support is required, sanitize SVG files using a trusted SVG sanitizer.
• Validate uploaded files server-side rather than relying only on the file extension.
• Validate MIME types and file signatures.
• Remove or reject <script> elements and JavaScript-capable SVG event handlers.
Proof of Concept Video
Link : https://drive.google.com/file/d/1nwr_EravSW9f62itP8sS6OpE3rqRDVkn/view?usp=sharing
References
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• OWASP Cross-Site Scripting Prevention Cheat Sheet
• OWASP File Upload Cheat Sheet
|
|---|
| Source | ⚠️ https://gist.github.com/MuhammadAmmar-Hacker/d0426a562fe0fa59efbfe7d45778ed27 |
|---|
| User | Muhammad_Ammar (UID 99381) |
|---|
| Submission | 08/19/2026 22:47 (28 days ago) |
|---|
| Moderation | 09/16/2026 10:08 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 405522 [SourceCodester Online Food Ordering System 1.0 Category Update update_category.php cross site scripting] |
|---|
| Points | 20 |
|---|