code-projects E-Commerce Website CVE-2025-12334

Exploitation requires a remote attacker to send a crafted HTTP request with malicious payload in one or more of the prod_name, prod_desc, or prod_cost parameters to /pages/product_add.php. A victim user must then click a malicious link or visit an attacker-controlled page that includes the payload, causing their browser to execute the injected script in the context of the vulnerable application. The vulnerability does not require prior authentication to craft the request (PR:N), but the impact depends on the victim's privilege level and whether the application stores/reflects the payload. Non-default configuration is NOT required - the vulnerability exists in the base installation.

This is a low-priority vulnerability despite public exploit availability. The CVSS 4.0 vector shows network accessibility (AV:N) but strictly limited impact: confidentiality and availability are unaffected (VC:N, VA:N), with only integrity showing low impact (VI:L). User interaction is required (UI:P), meaning victims must click a link or visit a crafted page - this significantly limits automated exploitation. The EPSS score of 0.04% (11th percentile) indicates minimal real-world exploitation likelihood, suggesting the public POC has generated limited attacker adoption. The discrepancy between 'publicly available' POC and very low EPSS indicates this is a known but low-urgency issue in the threat landscape. For defenders: this is a remediation candidate if patching is trivial, but not an emergency. For organizations running this abandoned e-commerce project, the low impact (XSS affecting primarily administrative users or other product managers) and low exploitation probability suggest deferral is acceptable if business continuity constraints exist.

An attacker crafts a malicious URL containing JavaScript in the prod_name parameter (e.g., /pages/product_add.php?prod_name=<script>stealCookie()</script>) and sends it to an authenticated product manager or admin user. When the victim clicks the link or visits the page, the unescaped JavaScript executes in their browser, allowing the attacker to steal session cookies, modify product data, or perform other actions under the victim's privilege level.