CVE-2025-12299: Simple Food Ordering System XSS Flaw

CVE-2025-12299 Overview

CVE-2025-12299 is a reflected/stored cross-site scripting (XSS) vulnerability in code-projects Simple Food Ordering System 1.0. The flaw resides in the /addproduct.php script, where the pname, category, and price parameters are not properly sanitized before being processed. Attackers can inject arbitrary JavaScript through these arguments and execute it in the context of another user's browser session. The vulnerability is remotely exploitable and requires user interaction to trigger. A public exploit disclosure exists, increasing the likelihood of opportunistic abuse against unpatched deployments of the Fabian Simple Food Ordering System.

Critical Impact
Remote attackers can inject script payloads via /addproduct.php parameters to hijack sessions, steal cookies, or deface administrative pages of the food ordering application.

Affected Products

Fabian Simple Food Ordering System 1.0
code-projects Simple Food Ordering System (/addproduct.php endpoint)
PHP-based deployments using the vulnerable addproduct.php handler

Discovery Timeline

2025-10-27 - CVE-2025-12299 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12299

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting under [CWE-79]. It affects the product management workflow of the application, specifically the /addproduct.php script used by administrators to add menu items. User-supplied values for pname (product name), category, and price are accepted through the HTTP request and rendered back into HTML output without adequate encoding or filtering.

Because the injected payload can persist in the product catalog view, an attacker who successfully places malicious content into these fields can influence any user who subsequently browses the affected page. Attack complexity is low, no authentication is required in the vulnerable path, and only limited user interaction is needed for exploitation.

Root Cause

The root cause is missing input sanitization and missing contextual output encoding in /addproduct.php. The application concatenates request parameters directly into HTML markup, allowing <script> tags, event handlers such as onerror or onmouseover, and other JavaScript-capable constructs to survive into the rendered page.

Attack Vector

Attackers deliver a crafted HTTP request to /addproduct.php containing a JavaScript payload inside the pname, category, or price parameter. When an administrator or user views the product list, the browser parses the injected markup and executes the attacker-controlled script. This enables session token theft, forced browser actions, credential phishing through injected forms, and pivoting toward additional admin functionality.

The vulnerability mechanism is a classic reflected/stored XSS pattern in PHP applications. No verified public proof-of-concept code is available in the referenced sources; consult the GitHub CVE Issue Discussion and VulDB #329971 for technical details.

Detection Methods for CVE-2025-12299

Indicators of Compromise

HTTP POST or GET requests to /addproduct.php containing <script>, javascript:, onerror=, or encoded variants in the pname, category, or price parameters.
Product catalog entries whose name, category, or price fields contain HTML tags or JavaScript syntax.
Outbound requests from administrator browsers to unfamiliar domains shortly after visiting the product management page.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect pname, category, and price parameters for HTML and JavaScript metacharacters.
Review web server access logs for anomalous parameter lengths and URL-encoded payloads targeting /addproduct.php.
Perform database audits of the products table for stored values containing tag delimiters (<, >) or JavaScript keywords.

Monitoring Recommendations

Alert on repeated failed or malformed POST requests to /addproduct.php from a single source IP.
Correlate administrator session activity with unexpected DOM-modifying content served from the application.
Monitor Content Security Policy (CSP) violation reports to surface script execution attempts from injected inline handlers.

How to Mitigate CVE-2025-12299

Immediate Actions Required

Restrict access to /addproduct.php to authenticated administrators over a trusted network until sanitization fixes are applied.
Audit the products table and remove any entries containing HTML or JavaScript content in the name, category, or price columns.
Deploy a WAF signature that blocks XSS payloads targeting the vulnerable parameters.

Patch Information

At the time of publication, no official vendor patch is referenced in the NVD advisory for Fabian Simple Food Ordering System 1.0. Administrators should apply source-level fixes: validate that price is numeric, restrict pname and category to an allow-list of characters, and apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to every output rendering these fields. Track updates via the VulDB CTI ID #329971 entry.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Front the application with a reverse proxy that strips HTML tags from pname, category, and price request parameters.
Isolate the administrative interface behind VPN or IP allow-listing to reduce remote exposure.

bash

# Example: Nginx rule to block obvious XSS payloads on the vulnerable endpoint
location = /addproduct.php {
    if ($args ~* "(<|%3C)script") { return 403; }
    if ($request_body ~* "(<|%3C)script") { return 403; }
    proxy_pass http://backend;
}