Vulnerabilidad de Cross-Site Scripting (XSS) en contact.php del sistema de pedidos de comida en línea code-projects

Successful exploitation of CVE-2026-4898 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and redirection to phishing sites. The attacker could potentially gain access to sensitive user data, such as order history, payment information, and personal details. Given the publicly available exploit, the risk of widespread exploitation is significant, particularly for systems with vulnerable configurations.

Organizations utilizing the Online Food Ordering System version 1.0, particularly those with publicly accessible instances, are at risk. Shared hosting environments where multiple users share the same server resources are especially vulnerable, as a compromise of one user's account could potentially impact others.

• php / web:

curl -I 'http://your-target-domain.com/dbfood/contact.php?Name=<script>alert(1)</script>' | grep -i content-type

• generic web:

curl -s 'http://your-target-domain.com/dbfood/contact.php?Name=<script>alert(1)</script>' | grep 'alert(1)'

1. 2026-03-26Disclosure

   disclosure

1. Reservado2026-03-26
2. Publicada2026-03-26
3. Modificada2026-03-27
4. EPSS actualizado2026-04-03

The primary mitigation for CVE-2026-4898 is to upgrade to a patched version of the Online Food Ordering System. As no fixed version is specified, thoroughly review the codebase for the vulnerable parameter handling in /dbfood/contact.php. Input validation and sanitization are crucial. Implement strict input validation on the 'Name' parameter to prevent the injection of malicious scripts. Consider using a Web Application Firewall (WAF) with XSS protection rules to filter out malicious requests. Regularly scan the application for vulnerabilities using automated tools.