Description

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T14:17:27.367Z",
  "pubdate": "2026-08-31T14:17:27.367Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the 'Newsletter Subscription' component of the 'code-projects Online Shopping System 1.0'.\nThe vulnerability manifests in the '/offersmail.php' script, specifically due to improper handling of the 'email' argument during HTTP request processing.\nThis vulnerability is categorized as a Reflected XSS flaw, allowing an unauthenticated remote attacker to inject arbitrary malicious scripts into the web pages viewed by other users.\nThe successful exploitation of this flaw can lead to unauthorized execution of JavaScript in the victim's browser context, potentially resulting in session hijacking, theft of sensitive user data (such as session tokens or credentials), and unauthorized actions performed on behalf of the user.\nThe vulnerability is remotely exploitable without requiring prior authentication, and public exploits are reportedly available, increasing the risk of active exploitation.\nOrganizations using this software should treat this as a high-priority security concern due to the ease of exploitation and the potential for full compromise of client-side security.",
  "technicalDetails": "The vulnerability is located in the '/offersmail.php' file, which serves as an endpoint for the Newsletter Subscription module in code-projects Online Shopping System 1.0.\nThe root cause of this vulnerability is the failure of the application to properly sanitize or validate user-supplied input provided through the 'email' HTTP GET/POST parameter before reflecting it back to the user's browser.\nIn a standard XSS attack flow, the attacker constructs a malicious URL containing a crafted payload within the 'email' argument (e.g., <script>alert(document.cookie)</script>).\nWhen a legitimate user or administrator clicks on the crafted link, the server-side script '/offersmail.php' receives the input and embeds the malicious payload directly into the HTML response generated for the client.\nThe victim's browser, receiving the modified HTML content, treats the attacker-supplied script as trusted code originating from the legitimate application's origin, thereby executing the script in the context of the user's session.\nBecause this is a reflected vulnerability, it does not require persistent storage of the payload on the server (non-persistent XSS), but relies on social engineering or link distribution to trigger the execution on a target's browser.\nThe lack of input validation allows for the bypassing of standard security controls that expect properly formatted email addresses, as the application fails to enforce RFC-compliant syntax or escape special characters like <, >, \", and '.\nThe impact includes the ability for an attacker to perform unauthorized actions such as modifying DOM elements, redirecting users to malicious sites, or performing API calls that appear to originate from the user's authenticated session.\nFurthermore, since the application does not explicitly mandate specific privilege levels for the newsletter submission process, the attack vector is accessible to any unauthenticated remote user, maximizing the threat surface for all visitors to the online shopping system.\nThe post-exploitation scenario is limited only by the privileges of the victim; if an administrator visits the link, the attacker could theoretically perform administrative actions or exfiltrate sensitive backend configurations accessible via the web interface."
}