Description

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount_1 results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-16T01:17:07.840Z",
  "pubdate": "2026-08-16T01:17:07.840Z",
  "executiveSummary": "A security vulnerability has been identified in the code-projects Online Shopping System 1.0 application, specifically within the /checkout.php endpoint. The flaw manifests as a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input passed via the amount_1 parameter. This security defect allows remote threat actors to inject malicious client-side scripts, typically JavaScript, into the application's response. When rendered by a victim's web browser, the injected script executes within the context of the user's session, potentially leading to session hijacking, credential theft, redirection to malicious infrastructure, or unauthorized actions performed on behalf of the authenticated user. The vulnerability is publicly disclosed, increasing the risk of automated or targeted exploitation in the wild. Successful exploitation requires network access to the target application and typically relies on social engineering or man-in-the-middle vectors to deliver the malicious payload to the victim through the vulnerable parameter, as the attack is initiated remotely without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the /checkout.php component of code-projects Online Shopping System 1.0, specifically stemming from insufficient input sanitization and output encoding of the amount_1 parameter. The root cause of this Cross-Site Scripting vulnerability is the direct reflection of untrusted HTTP request data back into the generated Hypertext Markup Language (HTML) response without proper contextual output encoding or structural validation.\nDuring the standard execution flow of the application, input provided via the amount_1 parameter within the HTTP request is processed by the backend script and subsequently embedded into the HTTP response returned to the client browser. Because the application fails to sanitize special characters such as angle brackets (<, >), quotes (\", '), and script delimiters, an attacker can supply a crafted payload containing arbitrary HTML or JavaScript code.\nThe attack vector is network-based and exploitable remotely. An unauthenticated attacker constructs a malicious Uniform Resource Locator (URL) or an automated payload submission targeting the /checkout.php script, incorporating the XSS payload within the amount_1 parameter. When a victim accesses the crafted link or interacts with the manipulated checkout workflow, the server processes the request and returns a response containing the unescaped malicious payload.\nUpon receiving the HTTP response, the victim's web browser parses the payload as executable code rather than plain text or numeric data, executing the script within the security context of the victim's active session. This enables the script to access Document Object Model (DOM) elements, read session cookies, extract sensitive local storage data, or perform unauthorized interactions with the application APIs. The post-exploitation impact depends heavily on the privileges of the affected user session and the specific script payload delivered by the attacker."
}