code-projects E-Commerce Website CVE-2025-12335

Exploitation requires the supplier update page (/pages/supplier_update.php) to be accessible to the attacker (typically via public URL or after initial authentication to the e-commerce platform). The attacker must craft a URL or form submission with malicious input in the supp_name or supp_address parameters. Crucially, the target user must visit the malicious URL or submit a form containing the payload - remote, unauthenticated code execution is not possible. The payload is only executed if the application reflects the unencoded input back to the browser in the HTTP response or stores it unsanitized and displays it to other users (stored XSS). If the application applies output encoding by default or if browsers enforce strict CSP policies, exploitation is mitigated.

Multiple signals indicate low real-world priority despite public disclosure. CVSS 2.1 and EPSS 0.04% (11th percentile) align - this is a low-severity flaw with minimal exploitation probability. The CVSS vector confirms no authentication required (PR:N) and network accessibility (AV:N), but mandatory user interaction (UI:P) is a significant barrier to widespread abuse. Although publicly available exploit code exists, the integrity-only impact (VI:L, no confidentiality or availability loss) and narrow scope limit practical harm. This is typical of low-value phishing vectors where an attacker must trick a user into clicking a malicious link targeting a single e-commerce site. No KEV (CISA Known Exploited Vulnerabilities) listing is indicated, suggesting no observed active exploitation in the wild despite disclosure. Organizations using this product should remediate, but this does not require emergency incident response procedures.

An attacker crafts a malicious URL containing JavaScript payload in the supp_name parameter (e.g., /pages/supplier_update.php?supp_name=<script>alert('XSS')</script>) and sends it to a victim via phishing email or social engineering. When the victim clicks the link and the page loads, the unescaped payload executes in their browser, potentially stealing session cookies, capturing form input, or redirecting them to a credential-stealing page. The attacker gains no direct access but can impersonate the victim within the e-commerce site's session.