CVE-2026-5836
Cross-Site Scripting in Online Shoe Store /admin_product.php
Publication date: 2026-04-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5836 is a Cross-Site Scripting (XSS) vulnerability found in version 1.0 of the Online Shoe Store project, specifically in the file /admin/admin_product.php.
The vulnerability occurs because the application directly outputs user-supplied input from the product_name parameter to the web page without proper encoding or filtering.
This lack of input validation and output encoding allows attackers to inject malicious JavaScript code, which executes in the victim's browser.
Exploitation does not require any login or authorization, making it remotely exploitable.
How can this vulnerability impact me? :
This vulnerability can have significant impacts including:
- Attackers can steal sensitive information such as cookies and session tokens.
- Perform unauthorized actions on behalf of the victim.
- Deface web pages or redirect users to malicious sites.
- Potentially gain control over the victim's browser.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the input parameter `product_name` in the `/admin/admin_product.php` file for cross-site scripting (XSS) issues.
A common method is to inject a proof-of-concept payload such as `<script>prompt(/xss/);</script>` into the `product_name` parameter and observe if the script executes in the browser.
For example, you can use curl or a browser to send a request like:
- curl -G --data-urlencode "product_name=<script>prompt(/xss/);</script>" http://yourserver/admin/admin_product.php
If the script executes or the payload is reflected without proper encoding or filtering, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Implement proper output encoding for the `product_name` parameter to ensure user input is treated as text, not executable code.
- Apply strict input validation and filtering to reject or sanitize malicious content such as script tags.
- Deploy a strict Content Security Policy (CSP) to restrict sources of executable scripts and prevent unauthorized script execution.
- Set the `HttpOnly` and `Secure` flags on cookies to protect sensitive session data from being accessed via JavaScript or transmitted insecurely.
- Conduct regular security audits and code reviews to detect and fix XSS and other vulnerabilities promptly.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Cross-Site Scripting (XSS) vulnerability in the Online Shoe Store 1.0 allows attackers to steal sensitive information such as cookies and session tokens, perform unauthorized actions, and potentially gain control over users' browsers.
Such unauthorized access and potential data theft can lead to violations of data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access and breaches.
Failure to remediate this vulnerability could result in non-compliance with these standards due to inadequate protection of user data and privacy.