PT-2025-25576 · Unknown · Codeastro Food Ordering System

Subhash Paudel · Published 2025-06-16 · Updated 2025-07-18 · CVE-2025-6131

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeAstro Food Ordering System version 1.0

Description A cross-site scripting (XSS) vulnerability exists due to the manipulation of the Restaurant Name/Address argument within a POST request parameter handler. This affects an unknown function in the /admin/store/edit/ file. The vulnerability allows for remote attacks. The exploit for this issue has been publicly disclosed.

Recommendations CodeAstro Food Ordering System version 1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-6131

Affected Products

Codeastro Food Ordering System

References · 11

• 🔥 https://github.com/Vanshdhawan188/Food-Ordering-System-in-PHP-CodeIgniter-/blob/main/Stored%20Cross-Site%20Scripting%20(XSS).md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-6131 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6131 · Vendor Advisory
• https://twitter.com/CVEnew/status/1934666089150992407 · Twitter Post
• https://vuldb.com/?ctiid.312600 · Note
• https://twitter.com/VulmonFeeds/status/1934676879471988895 · Twitter Post
• https://codeastro.com · Note
• https://t.me/cvenotify/129425 · Telegram Post
• https://vuldb.com/?submit.592780 · Note
• https://vuldb.com/?id.312600 · Note
• https://t.me/cvetracker/26335 · Telegram Post