CVE-2025-6131
BaseFortify
Publication date: 2025-06-16
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codeastro | food_ordering_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-6131 is a stored cross-site scripting (XSS) vulnerability in the CodeAstro Food Ordering System 1.0, specifically in the POST request parameter handler for the /admin/store/edit/ endpoint. Attackers can inject malicious JavaScript code into the 'Restaurant Name' or 'Address' fields via the POST parameter, which is then stored persistently in the system's database. When other users access the affected profile page, the malicious script executes, potentially compromising user sessions or enabling other malicious actions. Exploitation requires an enhanced authentication level and user interaction. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious JavaScript code in the context of your web application users. This can lead to session hijacking, unauthorized actions performed on behalf of users, or other malicious activities that compromise data integrity and user trust. Since the malicious code is stored and executed when users visit affected pages, it can affect multiple users remotely. Exploitation requires authenticated access and user interaction. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /admin/store/edit/ endpoint for stored cross-site scripting (XSS) by injecting JavaScript payloads into the 'Restaurant Name' or 'Address' POST parameters and observing if the script is executed when the affected page is accessed. Since the vulnerability involves stored XSS, monitoring HTTP POST requests to /admin/store/edit/ with suspicious script content in these parameters can help detect exploitation attempts. Specific commands could include using curl or similar tools to send crafted POST requests, for example: curl -X POST -d "patname=<script>alert(1)</script>" https://target/admin/store/edit/ and then accessing the affected page to see if the script executes. Additionally, web application scanners that detect XSS vulnerabilities can be used to automate detection. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /admin/store/edit/ endpoint to trusted and authenticated users only, as exploitation requires elevated privileges. Since no known countermeasures or patches are currently available, consider disabling or replacing the affected component if possible. Additionally, implement input validation and output encoding to neutralize malicious scripts in the 'Restaurant Name' and 'Address' fields. Monitoring and alerting on suspicious POST requests to the vulnerable endpoint can also help mitigate exploitation risk. [2]