Heitaoa999

**Name of the Vulnerable Software and Affected Versions** SourceCodester Gadget Works Online Ordering System version 1.0 **Description** A critical issue was found in the component POST Parameter Handler, affecting an unknown part of the file /philosophy/admin/login.php. The manipulation of the `user email` argument leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For version 1.0, consider disabling the `user email` parameter in the POST request to the /philosophy/admin/login.php file until a patch is available. Restrict access to the /philosophy/admin/login.php file to minimize the risk of exploitation. Avoid using the `user email` argument in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Gadget Works Online Ordering System version 1.0 **Description** A vulnerability has been found in the SourceCodester Gadget Works Online Ordering System, affecting the component Add New User. The issue is related to the manipulation of the `U NAME` argument in the `/philosophy/admin/user/controller.php?action=add` endpoint, leading to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For SourceCodester Gadget Works Online Ordering System version 1.0, consider disabling the `Add New User` component or restricting access to the `/philosophy/admin/user/controller.php?action=add` endpoint until a patch is available. Avoid using the `U NAME` argument in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.