code-projects Online Food Ordering System Order order.php cross site scripting

Successful exploitation of CVE-2026-5157 enables an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to the theft of session cookies, allowing the attacker to impersonate the user and access sensitive data. Attackers could also inject malicious scripts to redirect users to phishing sites, display deceptive content, or modify the appearance of the application. Given the publicly available exploit, the risk of immediate exploitation is elevated, particularly for systems with weak input validation or insufficient security controls.

Organizations using Code-Projects Online Food Ordering System version 1.0, particularly those with publicly accessible instances and limited security controls, are at significant risk. Shared hosting environments where multiple users share the same server are also vulnerable, as an attacker could potentially exploit the vulnerability through another user's session.

• php / web: Examine access logs for requests to /form/order.php with unusual or suspicious values in the 'cust_id' parameter. Use grep to search for JavaScript code snippets within the application's output.

grep -i '<script' /var/log/apache2/access.log | grep /form/order.php

• generic web: Use curl to test the /form/order.php endpoint with a simple XSS payload (e.g., <script>alert('XSS')</script>). Inspect the response for the alert box.

curl -X POST -d "cust_id=<script>alert('XSS')</script>" http://your-server/form/order.php

1. 2026-03-30Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-03-30
3. Geändert2026-03-31
4. EPSS aktualisiert2026-04-07

The primary mitigation for CVE-2026-5157 is to upgrade to a patched version of Code-Projects Online Food Ordering System. Until an upgrade is possible, implement strict input validation on the 'cust_id' parameter in /form/order.php, ensuring that it only accepts expected data types and formats. Deploy a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting this specific endpoint. Consider implementing Content Security Policy (CSP) to restrict the sources from which scripts can be executed, further limiting the impact of a successful attack. After implementing mitigations, test the /form/order.php endpoint with various input strings to verify that the vulnerability is no longer exploitable.