CVE-2025-13793

Analysis

A reflected cross-site scripting (XSS) vulnerability exists in the winston-dsouza Ecommerce-Website project up to commit 87734c043269baac0b4cfe9664784462138b1b2e. The issue resides in the file /includes/header_menu.php, where the GET parameter Error is not properly sanitized before being rendered. This allows an attacker to inject arbitrary JavaScript or HTML through the Error argument [1].

Exploitation

The attack is exploitable remotely without authentication. A victim only needs to visit a crafted URL containing a malicious Error parameter, causing the injected script to execute in the context of the victim's browser session. The exploit has been made publicly available, increasing the risk of widespread scanning or targeted attacks [1].

Impact

Successful exploitation enables an attacker to perform actions that a normal user can, such as stealing session cookies, redirecting the victim to malicious sites, defacing the page, or triggering other client-side attacks. The CVSS score of 4.3 (Medium) reflects the need for user interaction (clicking a link) and the limited direct impact on the server [1].

Mitigation

The project uses a rolling release model, meaning no specific patched version is provided. The vendor was contacted but did not respond, so no official fix is available. Users should consider input validation on the Error parameter or implement a Web Application Firewall (WAF) rule to block malicious patterns until a fix is applied [1].