Cross-Site Scripting in Online Food Ordering System 1.0

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the SourceCodester Online Food Ordering System affecting category management. The issue occurs in admin/add_category.php where user input for category_title is stored without sanitization and later rendered unsafely in HTML output. Attackers can inject malicious JavaScript via the category title field, which executes when the category is viewed by other users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the admin/add_category.php and admin/category.php files exist in your SourceCodester Online Food Ordering System installation. Look for unsanitized user input in the category title field that is rendered directly in HTML output without encoding.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users viewing infected category listings may have their browsers compromised without any further interaction beyond viewing the page.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information if exposed through the XSS attack.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the admin/add_category.php and admin/category.php files to encode category titles using htmlspecialchars($title, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') when rendering them in HTML. Review all pages displaying stored category data for similar issues.

Useful 0 Not Useful 0