Executive brief
Froiden TableTrack is a restaurant management platform used to handle customer orders and administrative tasks. A security flaw allows unauthenticated customers to include malicious code within the 'order notes' field when placing an order. When a restaurant administrator views the order details, this code executes in their browser, potentially allowing the attacker to steal login sessions or perform unauthorized administrative actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Froiden TableTrack through version 1.3.10 due to improper neutralization of input in the 'order notes' field. An unauthenticated attacker can submit a malicious payload (HTML/JavaScript) during the customer order placement process. This payload is stored in the database and subsequently executed in the context of a Restaurant Admin's browser session when they view the order details. This can lead to session hijacking via cookie theft or the execution of unauthorized administrative functions. The vulnerability is tracked as CWE-79 and requires the administrator to view the compromised order to trigger the exploit.
Affected products
- Froiden TableTrack through 1.3.10
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory