PT-2025-37988 · Unknown · Food Ordering Review System

Chen1-Boop · Published 2025-09-16 · Updated 2025-09-20 · CVE-2025-56276

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code-projects Food Ordering Review System version 1.0

Description The Food Ordering Review System is susceptible to a Cross Site Scripting (XSS) issue within the registration function. An attacker can inject malicious JavaScript code as a username. When an administrator views user information, this triggers the XSS, potentially leading to the disclosure of the administrator's cookie information.

Recommendations As a temporary workaround, consider sanitizing user input within the registration function to prevent the injection of malicious scripts. Restrict the characters allowed in the username field during registration to prevent the entry of JavaScript code. Implement appropriate output encoding when displaying user information to administrators to neutralize any potential XSS payloads.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-56276

Affected Products

Food Ordering Review System

References · 5

• 🔥 https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56276.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56276 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56276 · Vendor Advisory
• https://twitter.com/CVEnew/status/1969291979885265311 · Twitter Post
• https://code-projects.org/food-ordering-review-system-in-php-with-source-code · Note