Online Shopping System EUVD-2026-59812

Exploitation requires the attacker to hold a valid low-privileged account on the target Online Shopping System 1.0 instance, consistent with PR:L in the CVSS 4.0 vector - anonymous unauthenticated exploitation is not supported by the available data. Additionally, a separate victim user must passively interact with the malicious content (UI:P), such as by visiting a crafted checkout URL or being redirected to one. The vulnerability is confirmed only for the amount_1 parameter in /checkout.php; no other parameters or endpoints are confirmed affected by this CVE. No special server-side configuration is required - the vulnerability exists in the default application state. Exploitation is limited by: (1) the requirement for an attacker-controlled account, (2) the need for victim interaction, and (3) the niche deployment footprint of this application.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) scores 5.1, indicating a moderate but practically meaningful risk: the attack is network-reachable with low complexity and no additional attack requirements, but is constrained by the need for low privileges (PR:L) and passive victim interaction (UI:P). The E:P exploit maturity modifier directly reflects the public GitHub proof-of-concept, making opportunistic exploitation feasible for script-level actors. No CISA KEV listing is present, so active exploitation is not confirmed, and no EPSS data was provided to further quantify exploitation probability. The integrity-only impact on the vulnerable system (VI:L) with no confidentiality or availability impact appears to understate XSS risk - reflected XSS can exfiltrate session cookies and perform authenticated actions on behalf of victims, a real confidentiality concern not captured in VC:N. Even a mid-sized municipal IT team in gliwice running a public-facing PHP shopping portal built on this codebase should treat remediation as urgent given POC availability, despite the absence of KEV confirmation. The primary risk limiter is the low-privilege prerequisite - anonymous exploitation is not possible based on the CVSS vector.

An attacker registers or uses an existing low-privileged account on a target site running Online Shopping System 1.0, then crafts a request to /checkout.php with a malicious JavaScript payload injected into the amount_1 parameter. When an administrative user or another authenticated customer is socially engineered or otherwise directed to load the manipulated checkout URL, the injected script executes in their browser, potentially stealing session tokens or performing actions under their identity. A working proof-of-concept demonstrating this attack is publicly available at https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul4.md.