Sourcecodester · Sourcecodester Gadget Works Online Ordering System · CVE-2023-1795
**Name of the Vulnerable Software and Affected Versions**
SourceCodester Gadget Works Online Ordering System version 1.0
**Description**
A problem was found in the processing of the file /admin/products/index.php, specifically in the GET Parameter Handler component. The issue can be exploited by manipulating the `view` argument with malicious input, such as `<script>alert(666)</script>`, leading to cross-site scripting. This can be initiated remotely.
**Recommendations**
For SourceCodester Gadget Works Online Ordering System version 1.0, consider disabling the `view` argument in the /admin/products/index.php file as a temporary workaround until a patch is available. Restrict access to the /admin/products/index.php file to minimize the risk of exploitation. Avoid using the `view` argument in the affected API endpoint until the issue is resolved.