The code-projects Online Food Ordering System version 1.0 contains a cross-site scripting vulnerability in the Order Module's /form/order.php file. Specifically, the cust_id argument is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability can be triggered remotely without authentication and requires user interaction to exploit. The CVSS 4.0 base score is 5.3, indicating medium severity. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the attack requires user interaction and does not escalate privileges or impact server confidentiality or integrity directly. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the cust_id parameter to mitigate XSS risks. Additionally, applying web application firewalls (WAF) rules that detect and block XSS payloads may provide temporary protection.