SourceCodester Simple Food Ordering System process_order.php cross site scripting

published 2023-02-18 3 y ago modified 2026-10-28 11 d ago also EUVD-2023-12890

cvss: 3.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits: 2; Exploit-DB

A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.

Timeline

2023-02-18 Published
2023-04-06 First public exploit (EDB-51292)

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-07-12)

Exploit prediction

2.69% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-51292 Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS) webapps, 2023-04-06
EDB-51287 Employee Task Management System v1.0 - SQL Injection on edit-task.php webapps, 2023-04-06
github.com https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Simple%20Food%20Ordering%20System%20-%20Authenticated%20Reflected%20XSS.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA	3.0	3.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

SourceCodester Simple Food Ordering System
simple_food_ordering_system_project simple_food_ordering_system

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /navaidzansari/CVE_Demo/blob/main/2023/Simple%20Food%20Ordering%20System%20-%20Authenticated%20Reflected%20XSS
exploit, third-party-advisory
vuldb.com /?id.221451
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.221451
signature, permissions-required, third-party-advisory

Sources

CVE List CVE-2023-0902
NVD CVE-2023-0902

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary