| tiêu đề | SOURCECODESTER SIMPLE FOOD ORDERING SYSTEM 1.0 / process_order.php order Cross Site Scripting |
|---|
| Mô tả | The Reflected Cross Site Scripting vulnerability is found on "SIMPLE FOOD ORDERING SYSTEM v1.0" process_order.php file, where the order parameter is not sanitizing the user input and executing the malicious code. This vulnerability is executed after login, Therefore, any malicious user can take advantage of this vulnerability and hijack the victim's cookie to take over his account by sending the malicious crafting URL.
Proof of Concept:
I verified the XSS attack with this payload: "process_order.php?order=<script>alert(1)<%2fscript>mjii5" to execute the attack.
Vendor Homepage:
https://www.sourcecodester.com
Software Link:
https://www.sourcecodester.com/php/15418/simple-food-ordering-system-client-side-phpmysqli-free-source-code.html
Google Dork: "inurl:sfos/process_order.php"
Recommendation:
Whoever uses this CMS, should update line no 41 of process_order.php with the following code to avoid cross-site scripting attack:
Old Code: <?php echo $_GET['order']; ?>
New Code: <?php echo htmlspecialchars(strip_tags($_GET['order'])); ?> |
|---|
| Nguồn | ⚠️ https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Simple%20Food%20Ordering%20System%20-%20Authenticated%20Reflected%20XSS.md |
|---|
| Người dùng | navaidansari (UID 41266) |
|---|
| Đệ trình | 17/02/2023 18:45 (cách đây 4 những năm) |
|---|
| Kiểm duyệt | 18/02/2023 08:31 (14 hours later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 221451 [SourceCodester Simple Food Ordering System 1.0 process_order.php order Tập lệnh chéo trang] |
|---|
| điểm | 20 |
|---|