CVE-2026-5834
Remote XSS in code-projects Online Shoe Store /admin Running.php
Publication date: 2026-04-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5834 is a Cross-Site Scripting (XSS) vulnerability found in version 1.0 of the Online Shoe Store project, specifically in the file /admin/admin_running.php.
The vulnerability occurs because the application directly outputs user-supplied input from the product_name parameter to the web page without proper encoding or filtering.
This lack of input validation and output encoding allows attackers to inject and execute arbitrary JavaScript code in the victim's browser.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including:
- Attackers can steal cookies, session tokens, or other sensitive information.
- Perform unauthorized actions on behalf of the victim.
- Deface web pages or redirect users to malicious sites.
- Potentially gain control over the victim’s browser.
Notably, exploitation does not require any login or authorization, making it easier for attackers to exploit remotely.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the affected parameter `product_name` in the `/admin/admin_running.php` file for Cross-Site Scripting (XSS) by injecting typical XSS payloads and observing if they execute in the browser.
- Use a web browser or tools like curl or wget to send requests with XSS payloads, for example: curl -G --data-urlencode "product_name=<script>prompt(/xss/);</script>" http://target/admin/admin_running.php
- Observe the response in the browser or HTTP response to see if the script executes or is reflected unencoded.
- Use automated web vulnerability scanners that test for reflected XSS vulnerabilities on the `product_name` parameter.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Implement proper output encoding for the `product_name` parameter to ensure user input is treated as text, not executable code.
- Apply strict input validation and filtering to sanitize or reject malicious inputs such as script tags.
- Deploy a Content Security Policy (CSP) to restrict sources of executable scripts and prevent inline script execution.
- Set secure cookie flags like HttpOnly and Secure to protect session cookies from theft via XSS.
- Conduct regular security audits and code reviews to detect and fix XSS and other vulnerabilities promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Cross-Site Scripting (XSS) vulnerability in the Online Shoe Store 1.0 allows attackers to steal sensitive information such as cookies and session tokens, perform unauthorized actions, and potentially gain control over users' browsers.
This exposure of sensitive user data and unauthorized access can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Failure to remediate this vulnerability promptly may result in non-compliance with these standards, as it compromises the confidentiality and integrity of user data.