Executive brief
Online Shoe Store is a web application used for managing an e-commerce storefront. A security flaw in the administrative interface allows an attacker to inject malicious scripts into the product management pages. If an administrator views the affected page, the attacker could potentially perform unauthorized actions or steal session information, though the exploit requires administrative access to initiate.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Online Shoe Store 1.0 project by code-projects. The flaw is located in the '/admin/admin_football.php' component due to insufficient sanitization of the 'product_name' parameter. An attacker can exploit this by submitting a malicious payload (e.g., <script>prompt(/xss/);</script>) which is then executed in the browser of any user viewing the administrative product list. While the CVSS metrics suggest high privileges are required, the researcher notes that the specific endpoint may be accessible without authorization in some configurations. A proof-of-concept exploit has been publicly disclosed.
Affected products
- code-projects Online Shoe Store 1.0
Timeline
- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-09: advisory: CVE-2026-5835 published.