Description

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-15T22:16:52.850Z",
  "pubdate": "2026-08-15T22:16:52.850Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability has been identified within code-projects Online Food Order System 1.0. The security flaw specifically resides in the file edit_food_items.php via manipulation of the dname argument. This vulnerability allows remote attackers to inject malicious client-side scripts, typically JavaScript, into web pages viewed by other users or administrators.\nThe impact of this vulnerability includes potential session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users within the affected application context. Remote exploitation of this flaw is achievable over the network without requiring prior authentication, and exploit details are currently public, significantly elevating the associated risk.\nOrganizations utilizing code-projects Online Food Order System 1.0 face immediate exposure to client-side attacks. Remediation requires rigorous input sanitization and context-aware output encoding to neutralize unauthorized script execution vectors.",
  "technicalDetails": "The vulnerability is classified as a cross-site scripting (XSS) flaw affecting code-projects Online Food Order System 1.0. The vulnerable component is located within the file edit_food_items.php, specifically tied to the handling of the dname argument. The root cause stems from insufficient validation and a lack of proper output encoding of user-supplied data before it is reflected back to the client browser.\nThe attack flow proceeds as follows: an unauthenticated or remote attacker crafts a malicious HTTP request targeting edit_food_items.php, injecting arbitrary JavaScript payloads into the dname parameter. When the application processes this request, it dynamically generates the response containing the unsanitized input and returns it to the victim's browser. The browser interprets the payload as legitimate script content and executes it within the security context of the victim's session.\nBecause the vulnerability is exposed via network protocols (HTTP/HTTPS) and can be triggered remotely, attackers can leverage publicly available exploit methods to target deployments. Successful exploitation requires the victim to interact with the malicious payload or link, leading to post-exploitation impacts such as DOM manipulation, cookie theft, session token compromise, and unauthorized administrative actions within the application environment."
}