CVE-2026-5157

Vulnerability

Analysis

A reflected cross-site scripting (XSS) vulnerability exists in code-projects Online Food Ordering System 1.0. The issue is located in the Order module's file /form/order.php. The application fails to properly sanitize the cust_id parameter supplied via HTTP GET requests before reflecting it in the HTML response [1].

Exploitation

The attack is performed remotely via crafted URLs containing malicious JavaScript payloads. No authentication is required to exploit the vulnerability, making it accessible to any remote attacker. The exploit is publicly available, reducing the barrier for exploitation [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the victim's browser context. Potential consequences include theft of session cookies, hijacking of authenticated sessions, redirection to malicious websites, injection of malicious content, and harvesting of user credentials [1].

Mitigation

The vulnerability affects version 1.0 of the product, hosted on code-projects.org [1][2]. As of the publication date, no official patch has been released. Users should sanitize and encode all user-supplied input in the cust_id parameter before rendering, or implement a web application firewall (WAF) rule to block malicious payloads until an update is provided.