This vulnerability affects code-projects Online Shopping System version 1.0. It is a cross-site scripting (XSS) issue caused by improper handling of the amount_1 parameter in the /checkout.php file. An attacker can remotely manipulate this parameter to inject malicious scripts. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity), indicating network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity. Exploit code is publicly available, but no official fix or patch has been published yet.

Successful exploitation allows an attacker to perform cross-site scripting attacks, potentially leading to session hijacking, defacement, or redirection of users to malicious sites. The impact is limited to the confidentiality and integrity of the affected system, with no direct availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization on the amount_1 parameter as a temporary mitigation. Monitor vendor channels for updates and patches.