This vulnerability in code-projects Online Shoe Store 1.0 involves improper handling of the product_name parameter in the /admin/admin_football.php file, allowing an attacker to perform cross-site scripting attacks. The attack vector is network accessible with low attack complexity and no privileges required to initiate the attack, but user interaction with high privileges is necessary to trigger it. The vulnerability does not involve any confidentiality, integrity, or availability impact beyond the XSS itself. The CVSS 4.0 base score is 4.8, indicating medium severity. No official fix or patch is currently available, and the vendor has not issued remediation guidance.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and elevated privileges, limiting the scope of impact. There is no indication of direct impact on system confidentiality, integrity, or availability beyond the XSS effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply strict input validation and output encoding on the product_name parameter in the /admin/admin_football.php file. Restrict access to the affected admin interface to trusted users only and monitor for suspicious activity. Avoid clicking on untrusted links that could exploit this vulnerability.