CVE-2025-12335
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the supplier_update.php page of code-projects E-Commerce Website 1.0 through the supp_name or supp_address parameters. When administrators or other users view the affected page, the scripts execute in their browsers, potentially stealing session cookies or performing unauthorized actions. Only systems running this specific e-commerce software are affected.
💻 Affected Systems
- code-projects E-Commerce Website
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain administrative access to the e-commerce platform, modify product data, access customer information, or deface the website.
Likely Case
Attackers will likely use this to steal session cookies from administrators or users viewing supplier pages, potentially leading to account compromise and limited data exposure.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
The exploit has been publicly disclosed and requires the attacker to have access to submit supplier data or trick someone with access to submit malicious input. Basic web application testing tools can easily detect and exploit this vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch is available. Consider implementing input validation and output encoding as described in workarounds, or migrating to a supported e-commerce platform.
🔧 Temporary Workarounds
Implement Input Validation and Output Encoding
PHPAdd server-side validation to sanitize supp_name and supp_address parameters, and implement proper output encoding when displaying these values.
Edit /pages/supplier_update.php to add: htmlspecialchars($_POST['supp_name'], ENT_QUOTES, 'UTF-8'); and htmlspecialchars($_POST['supp_address'], ENT_QUOTES, 'UTF-8');
Restrict Access to Supplier Pages
PHPImplement authentication and authorization checks to ensure only authorized users can access supplier management functions.
Add session validation at the beginning of supplier_update.php: if(!isset($_SESSION['admin_logged_in']) || $_SESSION['admin_logged_in'] !== true) { header('Location: login.php'); exit(); }
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules to block malicious input patterns.
- Disable or remove the supplier_update.php file if supplier management functionality is not required.
🔍 How to Verify
Check if Vulnerable:
Test by submitting HTML/JavaScript payloads in the supp_name or supp_address fields when updating supplier information and checking if they execute when the page is viewed.Check Version:
Check the software version in the admin panel or review the installation documentation. This vulnerability only affects version 1.0.Verify Fix Applied:
After implementing fixes, test with the same payloads to ensure they are properly sanitized and displayed as text rather than executing as scripts.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /pages/supplier_update.php with script tags or JavaScript in parameters
- Multiple failed attempts to access supplier pages without proper authentication
Network Indicators:
- HTTP requests containing <script> tags or JavaScript functions in supp_name or supp_address parameters
- Traffic patterns showing exploitation attempts from known malicious IPs
SIEM Query:
source="web_logs" AND (url="/pages/supplier_update.php" AND (param="supp_name" OR param="supp_address") AND (value="*<script>*" OR value="*javascript:*"))