CVE-2025-12300: Simple Food Ordering System XSS Flaw

CVE-2025-12300 Overview

CVE-2025-12300 is a reflected cross-site scripting (XSS) vulnerability in code-projects Simple Food Ordering System 1.0. The flaw resides in the /addcategory.php script, where the cname parameter is processed without proper sanitization or output encoding. Attackers can inject arbitrary JavaScript payloads through this parameter, causing execution in the browser context of any user who interacts with the crafted request. The issue has been publicly disclosed and a proof-of-concept exploit is available. The vulnerability requires user interaction to trigger and can be initiated remotely over the network.

Critical Impact
Remote attackers can inject arbitrary JavaScript into /addcategory.php via the cname parameter, enabling session hijacking, credential theft, and administrative action abuse in the food ordering application.

Affected Products

Fabian Simple Food Ordering System 1.0
The /addcategory.php component
The cname request parameter

Discovery Timeline

2025-10-27 - CVE-2025-12300 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12300

Vulnerability Analysis

The vulnerability is a classic reflected cross-site scripting flaw categorized under [CWE-79]. When a request is submitted to /addcategory.php, the application accepts the cname argument and reflects its value back into the HTTP response without encoding HTML control characters. An attacker who supplies JavaScript payloads through this parameter causes the browser to interpret injected markup as active script content.

Exploitation is remote and does not require authentication credentials. The attack does require user interaction, typically a victim clicking a crafted link or submitting a manipulated form. Successful exploitation results in script execution within the origin of the vulnerable application, exposing session cookies, stored credentials, and any administrative functions accessible to the victim.

The scope of impact is limited to browser-side integrity within the application session. Confidentiality of server data and availability of the application are not directly affected by the injection itself.

Root Cause

The root cause is missing input validation and output encoding on the cname parameter handled by /addcategory.php. User-supplied data flows directly into an HTML response context without contextual escaping. Standard defenses such as HTML entity encoding or the use of a templating engine with automatic escaping are absent.

Attack Vector

The attack vector is network-based. An attacker crafts a URL or form submission targeting /addcategory.php with a malicious cname value containing JavaScript. The attacker delivers the link through phishing, forums, or embedded content. When a victim, particularly an authenticated administrator, follows the link, the injected script executes in their browser session against the vulnerable host.

Refer to the GitHub Issue CVE Discussion and the VulDB #329972 Detail Page for the public proof-of-concept and additional technical context.

Detection Methods for CVE-2025-12300

Indicators of Compromise

HTTP requests to /addcategory.php containing script tags, event handlers, or encoded JavaScript inside the cname parameter
Web server access logs showing cname values with characters such as <, >, %3C, onerror=, or javascript:
Unexpected outbound browser requests from admin sessions to attacker-controlled hosts following category-related workflows

Detection Strategies

Deploy web application firewall (WAF) rules to inspect the cname parameter for XSS payload signatures and encoded variants
Review application access logs for anomalous query strings targeting /addcategory.php
Correlate authenticated administrator activity with suspicious referrers or externally originating links pointing to the ordering system

Monitoring Recommendations

Enable and centralize HTTP request logging with full query string capture for the Simple Food Ordering System host
Monitor Content Security Policy (CSP) violation reports if CSP headers are deployed
Alert on repeated requests to /addcategory.php from a single source containing suspicious parameter content

How to Mitigate CVE-2025-12300

Immediate Actions Required

Restrict access to /addcategory.php to authenticated administrators only and place the application behind a WAF that filters XSS payloads
Sanitize and HTML-encode the cname parameter on both input and output paths in the application code
Educate administrators to avoid clicking untrusted links that target the application origin

Patch Information

No vendor patch has been published for Simple Food Ordering System 1.0 at the time of NVD publication. Operators should apply source-level fixes by adding HTML entity encoding around all reflected values in /addcategory.php and validating that cname contains only expected characters such as alphanumerics and spaces. Track the VulDB #329972 Threat Report and Code Projects Security Resources for future advisories.

Workarounds

Add server-side input validation rejecting any cname value containing angle brackets, quotes, or script keywords
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Place the application behind a reverse proxy with XSS filtering rules until code-level fixes are applied

bash

# Example ModSecurity rule to block XSS payloads in the cname parameter
SecRule ARGS:cname "@rx (?i)(<script|onerror=|onload=|javascript:|<img|<svg)" \
    "id:1012300,phase:2,deny,status:403,\
    msg:'CVE-2025-12300 XSS attempt in cname parameter',\
    tag:'CWE-79',tag:'application-multi'"