Executive brief
SourceCodester Online Food Ordering System is a web application for managing food orders and categories. A stored cross-site scripting vulnerability in the category update feature allows authenticated administrators to upload malicious SVG images containing JavaScript code. When these images are accessed through the application, the embedded JavaScript executes in the browser, potentially allowing attackers to steal credentials, manipulate content, or perform unauthorized actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the category image upload functionality of the Online Food Ordering System v1.0. The vulnerability exists because the application accepts SVG file uploads without validating or sanitizing their XML content; SVG is an XML-based format capable of embedding JavaScript and event handlers. An authenticated administrator can upload a crafted SVG file containing malicious script tags or event handlers (e.g., <script> or onload attributes). When the uploaded SVG is directly accessed or rendered by a browser, the embedded JavaScript executes within the application's security context. The attack requires authentication but has network-level reachability; once exploited, the malicious payload persists on the server and executes for any user viewing the compromised image. No patch or official fix is mentioned in the advisory.
Affected products
- SourceCodester Online Food Ordering System 1.0
Timeline
- 2026-09-16: disclosed
- other: Public exploit proof-of-concept available