CVE-2025-12299
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the Simple Food Ordering System 1.0 through the /addproduct.php endpoint. When users view affected pages, these scripts execute in their browsers, potentially stealing session cookies or redirecting to malicious sites. Any organization using this specific version of the software is affected.
💻 Affected Systems
- code-projects Simple Food Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system control, deface websites, or redirect users to phishing/malware sites.
Likely Case
Session hijacking of regular users, credential theft, or website defacement through stored XSS payloads.
If Mitigated
Minimal impact with proper input validation and output encoding in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb.com. Attack requires ability to submit product data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for updates 2. Apply any available patches 3. Validate input sanitization in /addproduct.php
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement server-side validation of pname, category, and price parameters, and encode all output.
WAF Rule Implementation
allDeploy web application firewall rules to block XSS payloads in product parameters.
🧯 If You Can't Patch
- Disable or restrict access to /addproduct.php endpoint
- Implement Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Test /addproduct.php with XSS payloads in pname, category, or price parameters and check if they execute.Check Version:
Check software documentation or configuration files for version information.Verify Fix Applied:
Verify that XSS payloads in product parameters are properly sanitized and don't execute in browser.📡 Detection & Monitoring
Log Indicators:
- Unusual product names containing script tags or JavaScript in access logs
- Multiple failed product addition attempts with suspicious parameters
Network Indicators:
- HTTP requests to /addproduct.php with script tags or encoded payloads in parameters
SIEM Query:
source="web_logs" AND uri="/addproduct.php" AND (param="pname" OR param="category" OR param="price") AND (value="<script>" OR value="javascript:")