CVE-2025-12333
📋 TL;DR
This vulnerability in code-projects E-Commerce Website 1.0 allows attackers to inject malicious scripts via the supplier name or address fields in the supplier_add.php page. When exploited, it enables cross-site scripting attacks that can steal user sessions, redirect users, or deface the website. Anyone running this specific e-commerce software version is affected.
💻 Affected Systems
- code-projects E-Commerce Website
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, take over the e-commerce site, access customer data, and potentially compromise payment information.
Likely Case
Attackers inject malicious scripts that steal user session cookies, redirect users to phishing sites, or deface the supplier management interface.
If Mitigated
With proper input validation and output encoding, the attack fails to execute malicious scripts, limiting impact to failed exploitation attempts.
🎯 Exploit Status
Exploit details are publicly available on figshare and vuldb, making this easy to weaponize. Attack requires access to supplier management functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check code-projects.org for security updates. 2. If no patch exists, implement input validation and output encoding in supplier_add.php. 3. Sanitize supp_name and supp_address parameters before processing.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to reject or sanitize HTML/JavaScript in supplier name and address fields
Add input sanitization in supplier_add.php: htmlspecialchars($_POST['supp_name'], ENT_QUOTES, 'UTF-8')
Access Restriction
allRestrict access to supplier_add.php to authenticated administrators only
Add authentication check at top of supplier_add.php: if(!isset($_SESSION['admin'])) { header('Location: login.php'); exit(); }
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block XSS payloads in POST parameters
- Disable or remove the supplier_add.php file if supplier management is not required
🔍 How to Verify
Check if Vulnerable:
Test by submitting <script>alert('XSS')</script> in supplier name or address fields and check if script executesCheck Version:
Check the software version in admin panel or readme filesVerify Fix Applied:
Submit the same XSS payload and verify it's either sanitized or rejected without executing📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to supplier_add.php with script tags or JavaScript code in parameters
- Multiple failed login attempts followed by supplier_add.php access
Network Indicators:
- HTTP POST requests containing <script> tags or JavaScript functions in supplier name/address parameters
SIEM Query:
source="web_logs" AND uri_path="/pages/supplier_add.php" AND (param_name="supp_name" OR param_name="supp_address") AND param_value MATCHES "<script>|javascript:|onload=|onerror="