Kashipara Food Management System party_submit.php cross site scripting

The XSS vulnerability in Kashipara Food Management System allows an attacker to inject arbitrary JavaScript code into the application's web pages. This can be exploited to steal user cookies, redirect users to malicious websites, or deface the application. Successful exploitation could lead to unauthorized access to sensitive data, including user credentials and financial information. The impact is amplified if the application is used to manage sensitive data or process financial transactions. While the CVSS score is LOW, the potential for user compromise and data theft remains significant.

Organizations and individuals using Kashipara Food Management System versions 1.0 through 1.0 are at risk. This includes small businesses and non-profit organizations that rely on this system for food management and potentially handle sensitive user data. Shared hosting environments where multiple websites share the same server are particularly vulnerable, as a compromise of one website could potentially impact others.

• php / web:

grep -r "party_address" /var/www/html/party_submit.php

• generic web:

curl -I <food_management_system_url>/party_submit.php?party_address=<script>alert(1)</script>

• generic web: Check access/error logs for suspicious requests containing <script> tags or other XSS payloads targeting the party_address parameter. • generic web: Review the application's source code for inadequate input validation and output encoding of user-supplied data.

1. 2024-01-07Disclosure

   disclosure

2. 2024-01-07Patch

   patch

1. आरक्षित2024-01-06
2. प्रकाशित2024-01-07
3. संशोधित2025-06-03
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-0284 is to upgrade Kashipara Food Management System to version 1.0.1 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the partyaddress parameter within the partysubmit.php file. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Regularly review and update input sanitization routines to prevent similar vulnerabilities in the future. After upgrade, confirm by testing the party_submit.php endpoint with various malicious inputs to ensure the vulnerability is resolved.