Code-Projects Online Food Ordering System Cross-Site Scripting Vulnerability in Order Module

A reflected cross-site scripting vulnerability has been identified in version 1.0 of the Code-Projects Online Food Ordering System. The issue resides in the Order Module, specifically within the file '/form/order.php'. The vulnerability is triggered by manipulating the 'cust_id' parameter in HTTP GET requests, allowing attackers to inject malicious scripts that are executed in the context of the user's browser. This exploitation could lead to session hijacking, credential theft, or redirection to harmful websites. Notably, no authentication is required to carry out this attack.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser, potentially leading to session hijacking, theft of cookies or credentials, and injection of malicious content into the page.

Reproduction

To reproduce this vulnerability, send a GET request to '/form/order.php' with a 'cust_id' parameter containing a script tag, such as '<script>alert(document.cookie)</script>'. The injected script will execute immediately, demonstrating the cross-site scripting vulnerability.

Remediation

It is recommended to sanitize user input before rendering it in HTML, validate that parameters contain only expected values, implement a restrictive Content Security Policy, and follow secure development practices by not reflecting user input directly into HTML responses.