This vulnerability in code-projects Online Shoe Store 1.0 involves improper sanitization of the product_name argument in the /admin/admin_product.php file, allowing an attacker to inject malicious scripts (cross-site scripting). The attack vector is remote, with low attack complexity and no privileges required for the initial attack vector, but it requires user interaction and some level of privileges (PR:H). The CVSS 4.0 base score is 4.8, indicating medium severity. No official patch or vendor remediation level has been provided yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an authenticated administrator user, potentially leading to session hijacking, defacement, or other malicious actions within the admin interface. However, the impact is limited by the requirement for user interaction and elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when handling input in the affected parameter and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns targeting product_name. Avoid using the affected functionality with untrusted input where possible.