CVE-2025-6778: Food Distributor Site XSS Vulnerability

CVE-2025-6778 Overview

CVE-2025-6778 is a cross-site scripting (XSS) vulnerability in code-projects Food Distributor Site 1.0. The flaw resides in the /admin/save_settings.php endpoint, where the site_phone, site_email, and address parameters are not properly sanitized before being stored and rendered. An authenticated attacker with administrative privileges can inject arbitrary JavaScript that executes in the browser of any user who visits pages displaying the affected settings. The issue is classified under [CWE-79] and is remotely exploitable over the network. Public disclosure of the exploit technique has already occurred through third-party research repositories.

Critical Impact
Successful exploitation enables persistent script execution in administrative contexts, which can be leveraged for session theft, credential harvesting, or defacement of the storefront.

Affected Products

code-projects Food Distributor Site 1.0
Vendor: Fabian
CPE: cpe:2.3:a:fabian:food_distributor_site:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-06-27 - CVE-2025-6778 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6778

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw affecting the administrative settings handler in Food Distributor Site 1.0. The save_settings.php script processes user-supplied values for the site_phone, site_email, and address fields without applying output encoding or input filtering. Any HTML or JavaScript submitted through these parameters is written to persistent storage and later rendered inside administrative and public-facing pages. When a browser parses the injected markup, the attacker-controlled script runs under the origin of the vulnerable application.

Because the payload is persistent, exploitation does not require the attacker to interact with each victim individually. The malicious code executes whenever a user loads a page that displays contact or address information from the settings table.

Root Cause

The root cause is missing neutralization of special elements used in a web page, consistent with [CWE-79]. The application concatenates raw parameter values directly into HTML output without invoking encoding routines such as htmlspecialchars() on the settings fields.

Attack Vector

Exploitation requires network access to the administrative interface and valid high-privilege credentials, plus victim interaction with the rendered page. An attacker submits crafted values through the settings form. Subsequent visits to any page consuming those fields trigger execution of the payload in the victim's browser session.

See the public exploit write-up on GitHub and the companion advisory for technical details on the injection payloads.

Detection Methods for CVE-2025-6778

Indicators of Compromise

Settings records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> inside the site_phone, site_email, or address columns.
Web server access log entries showing POST requests to /admin/save_settings.php with URL-encoded angle brackets or JavaScript event handlers in the request body.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading pages that display site settings.

Detection Strategies

Inspect database contents for the affected settings fields and flag any values containing markup or control characters.
Deploy web application firewall rules that identify script tags, event handlers, and JavaScript URI schemes in POST parameters targeting the admin settings endpoint.
Correlate administrator authentication events with subsequent anomalous DOM activity or unexpected outbound requests from admin sessions.

Monitoring Recommendations

Enable verbose logging on /admin/save_settings.php and retain full request bodies for retrospective analysis.
Alert on repeated modifications to the settings table from a single administrative account within a short window.
Monitor Content Security Policy (CSP) violation reports if CSP is deployed, since injected inline scripts will trigger reports.

How to Mitigate CVE-2025-6778

Immediate Actions Required

Restrict access to the /admin/ directory using network controls or reverse-proxy allowlists until a fix is applied.
Audit the settings table and remove any values that contain HTML markup or scripting constructs.
Rotate administrative credentials and invalidate active sessions to contain any prior compromise.

Patch Information

No official vendor patch is listed for Food Distributor Site 1.0 in the VulDB entry at the time of publication. Organizations running this application should apply source-level fixes by adding server-side input validation and output encoding to save_settings.php, or discontinue use of the affected version.

Workarounds

Wrap all rendering of site_phone, site_email, and address values with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before echoing to HTML contexts.
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources on administrative pages.
Enforce input validation on the settings form to reject non-conforming characters such as <, >, and quotation marks in phone, email, and address fields.

bash

# Example Apache configuration to restrict admin access by IP
<Location "/admin/save_settings.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

# Example response header to enable a restrictive CSP
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"