Description

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such manipulation of the argument Success leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-25T21:18:23.847Z",
  "pubdate": "2026-08-25T21:18:23.847Z",
  "executiveSummary": "A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Online Shopping System 1.0, specifically within the /admin/sumit_form.php component.\nThe vulnerability originates from the improper neutralization of user-supplied input provided through the 'Success' argument, which is then rendered directly in the administrator's browser context.\nThis flaw enables remote, unauthenticated or low-privileged attackers to inject arbitrary client-side scripts, such as JavaScript, into the victim's session.\nSuccessful exploitation can result in unauthorized actions performed on behalf of an administrator, session hijacking, credential theft, or unauthorized redirection to malicious external domains.\nGiven that the exploit is publicly disclosed, the risk of active exploitation is significant. It is imperative that organizations running this software version implement input validation and output encoding mechanisms to mitigate this threat.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw located in the /admin/sumit_form.php file. The root cause is the application's failure to perform adequate input validation and context-aware output encoding on the 'Success' HTTP GET/POST parameter before it is reflected back to the user's browser in the HTML response.\nWhen an attacker crafts a malicious URL containing a JavaScript payload within the 'Success' argument (e.g., /admin/sumit_form.php?Success=<script>alert(document.cookie)</script>), the web application processes the request and embeds the unvalidated input directly into the rendered page source.\nThe browser, interpreting the server's response, treats the injected malicious string as a legitimate script element and executes it within the security context of the affected administrative session. Because the script executes in the victim's browser, it gains access to sensitive data such as session cookies, local storage, and the ability to manipulate the Document Object Model (DOM).\nThe attack flow requires the attacker to entice an authenticated administrator to navigate to the crafted URL. Upon clicking the link, the victim's browser sends the request to the vulnerable endpoint. The server responds with an HTML page containing the attacker's payload. The victim's browser subsequently executes the payload, leading to immediate code execution in the context of the administrative panel.\nThis vulnerability is particularly severe because it allows for the exfiltration of administrative session tokens. Once stolen, these tokens enable an attacker to impersonate the administrator without requiring knowledge of actual credentials. Furthermore, attackers can leverage this access to modify application configurations, extract sensitive database information, or execute unauthorized administrative functions, effectively bypassing standard authentication controls.\nAs the application is designed for administrative use, the potential impact is high, as the script executes with the full privileges of the logged-in administrator. The lack of proper sanitization at the server-side entry point is the primary technical failure, rendering the system vulnerable to any malicious input vectors injected via the 'Success' parameter."
}