Executive brief
Online Shopping System is a PHP-based e-commerce platform used to manage online stores. A reflected cross-site scripting (XSS) vulnerability in the admin panel allows an attacker to inject malicious code that executes in an administrator's browser, potentially leading to session hijacking, credential theft, and unauthorized administrative actions.
Technical details
The vulnerability is a reflected XSS flaw in /admin/sumit_form.php where the "success" parameter (accessible via GET/POST) is directly output into an HTML input element's value attribute without sanitization or encoding. The vulnerable code retrieves $_REQUEST['success'] and echoes it into the page without any HTML entity encoding or input validation. An attacker can craft a URL containing a payload like "><script>alert(888)</script> which breaks out of the attribute context and executes arbitrary JavaScript in the victim's browser. The attack requires the victim (typically an admin) to click a malicious link; no authentication bypass is needed for the XSS itself, though admin access increases impact. A patch should implement output encoding (e.g., htmlspecialchars) or input validation on the success parameter.
Affected products
- code-projects Online Shopping System 1.0
Timeline
- 2026-08-25: disclosed
- other: Exploit PoC publicly available on GitHub