CVE-2023-0902
Published: 18 February 2023
Summary
CVE-2023-0902 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Simple Food Ordering System Project Simple Food Ordering System. Its CVSS base score is 3.5 (Low).
Operationally, ranked in the top 13.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as problematic was identified in SourceCodester Simple Food Ordering System version 1.0 and assigned CVE-2023-0902. The issue is a cross-site scripting flaw (CWE-79) located in an unknown portion of the file process_order.php, where manipulation of the order argument permits injection of malicious scripts. The flaw is remotely exploitable with a CVSS 3.1 base score of 3.5 and was publicly disclosed with proof-of-concept material.
An attacker with low-privileged authenticated access can supply a crafted order value that triggers reflected XSS when the affected page is viewed by a user. Successful exploitation allows the attacker to execute arbitrary script code in the victim's browser context, resulting in limited integrity impact such as unauthorized actions or content alteration while confidentiality and availability remain unaffected.
EPSS for the CVE rose from low values to a recorded peak of 0.0882 before receding to the current score of 0.0272, indicating a period of increased exploitation interest after disclosure. No official vendor advisories or patch details appear among the referenced sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12890
Vulnerability details
A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible…
more
to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.