Description

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T08:16:59.580Z",
  "pubdate": "2026-08-17T08:16:59.580Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified within code-projects Online Shopping System 1.0, specifically residing in an unknown function within the offersmail.php file. The flaw arises due to the inadequate validation and sanitization of user-supplied input passed via the email parameter. An unauthenticated remote attacker can exploit this weakness by injecting malicious client-side scripts, typically JavaScript, into the application. When rendered by a victim's browser, the injected payload executes within the context of the user's session, potentially leading to unauthorized actions, session hijacking, credential theft, or the manipulation of sensitive user interface elements. Given that exploit details have been publicly disclosed, the risk of exploitation is elevated. Successful execution requires no prior authentication or specialized privileges, allowing remote attackers to target users over the network provided they can trick a user into interacting with the malicious input or directly navigating a crafted URL.",
  "technicalDetails": "The identified vulnerability is a Reflected or Stored Cross-Site Scripting (XSS) flaw stemming from insecure handling of the email argument within the offersmail.php script in code-projects Online Shopping System 1.0. The root cause of the vulnerability is the lack of context-aware output encoding and rigorous input validation. When the application receives input through the email parameter, it dynamically incorporates this data directly into the Hypertext Markup Language (HTML) response without properly neutralizing special characters such as angle brackets (< and >), quotation marks, or script tags. The vulnerable component is the server-side script offersmail.php, which processes the affected parameter. Attack vector analysis indicates that the vulnerability is exploitable remotely over the network without requiring authentication or specific user privileges. The attack flow proceeds as follows: First, the attacker crafts a malicious input string containing executable JavaScript payloads disguised as or injected into the email parameter. Second, the attacker induces a victim to submit this payload or click a maliciously constructed URL pointing to offersmail.php where the payload is reflected or processed. Third, the application processes the request and embeds the unsanitized email value directly into the HTTP response body returned to the browser. Fourth, the victim's web browser parses the response, fails to distinguish between legitimate application markup and malicious script content, and subsequently executes the embedded JavaScript within the security context of the victim's active session. Post-exploitation impact includes the potential theft of session cookies, exposure of sensitive user data, redirection to malicious external sites, and unauthorized actions performed on behalf of the authenticated victim."
}