Platform
php
Component
cafeorder_vuln_xss
Fixed in
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in Simple Cafe Ordering System versions 1.0 through 1.0. This flaw allows attackers to inject malicious scripts into the application via manipulation of the productname argument within the /addto_cart file. Successful exploitation can lead to session hijacking or defacement, impacting users of the system. A fix is available in version 1.0.1.
The XSS vulnerability in Simple Cafe Ordering System allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a user's browser when they visit a crafted URL. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or modify the content of the page. The remote nature of the exploit means that an attacker doesn't need to be on the same network as the server to exploit the vulnerability. The availability of a public proof-of-concept significantly increases the risk of exploitation.
A public proof-of-concept for CVE-2025-13202 is available, indicating a relatively high likelihood of exploitation. The vulnerability was disclosed on 2025-11-15. While the CVSS score is LOW, the ease of exploitation due to the public PoC warrants immediate attention. No KEV listing or confirmed exploitation campaigns are currently known.
Exploit Status
EPSS
0.05% (15% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-13202 is to upgrade Simple Cafe Ordering System to version 1.0.1 or later. If upgrading is not immediately possible, consider implementing input validation and output encoding on the productname parameter within the /addto_cart file. This can help prevent malicious scripts from being injected. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and sanitize user input to minimize the risk of XSS vulnerabilities.
Update to a patched version or disable the vulnerable functionality. Validate and sanitize user inputs in the product_name parameter to prevent malicious code injection. Implement a content security policy (CSP) to mitigate XSS attacks.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-13202 is a cross-site scripting (XSS) vulnerability affecting Simple Cafe Ordering System versions 1.0 through 1.0. It allows attackers to inject malicious scripts via the productname parameter in /addto_cart.
You are affected if you are using Simple Cafe Ordering System version 1.0. Upgrade to version 1.0.1 to mitigate the risk.
Upgrade Simple Cafe Ordering System to version 1.0.1 or later. As a temporary workaround, implement input validation and output encoding on the product_name parameter.
A public proof-of-concept exists, suggesting a potential for active exploitation. Monitor your systems for suspicious activity.
Refer to the Simple Cafe Ordering System project's official website or repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.