A vulnerability was found in code-projects Online Shop 1

CVE-2025-0175 is a reflected XSS issue in code-projects Online Shop 1.0. The vulnerable path is /view.php, where attacker-controlled name and details parameters are echoed into the page without output encoding; the public PoC shows direct use of $_GET['name'] and $_GET['details']. I could not find any authoritative evidence of a vendor-fixed release, so the affected range is effectively 1.0 / all known public downloads of this project.

Operationally, the original LOW rating is the right neighborhood and arguably still a bit generous for enterprise patch queues. NVD later modeled it as a higher-score web XSS case because the endpoint appears reachable without auth, but in the real world this still needs a victim to load a crafted URL, usually needs a live session to matter, and sits in an educational PHP sample app that is far less prevalent than mainstream commerce platforms.

Why this verdict

• Start from 3.5 LOW: the vendor baseline already assumes a modest web-impact bug, and nothing here justifies a fleet-priority upgrade.
• Exposure population cuts the score down: this is a downloadable training/demo PHP shop, not Exchange, Confluence, or a VPN edge product. Real enterprise prevalence is likely tiny.
• Requires a prior human step: the attacker typically needs a victim to click or load a crafted link. That implies social engineering or another delivery channel, which is a compounding friction point.
• Blast radius is app-local: successful execution lives in the browser origin of this single shop app. Without a privileged victim session or adjacent flaws, it does not become host takeover or domain compromise.
• Threat intel is quiet: no KEV entry, no credible campaign reporting, and a very low EPSS all argue against elevating this above backlog-grade work.

Why not higher?

NVD's higher technical score reflects a generic internet-reachable XSS model, but enterprise defenders should score the *whole chain*, not the sink in isolation. Here that chain narrows fast: niche deployment, reflected delivery, user interaction, and session-scoped impact all push down operational severity.

Why not lower?

This is still a real web exploit with a public PoC, not a theoretical code smell. If you actually run this app and staff use it with authenticated sessions, an attacker can still steal app-context data or perform actions as the victim, so it should not be ignored outright.

1. Retire or quarantine the app — If this package is a lab, student, or forgotten internal utility, remove it from production exposure or restrict it to admin VPN access. For a LOW verdict there is no mitigation SLA; treat this as backlog hygiene and complete it in the next normal application cleanup cycle.
2. Add output encoding in view.php — Wrap name and details with htmlspecialchars(..., ENT_QUOTES, 'UTF-8') or equivalent before rendering. Because no upstream fixed version was identified, your practical remediation is a local code fix in your maintained copy, again with no SLA beyond normal backlog hygiene.
3. Enforce a restrictive CSP — A Content Security Policy that blocks inline script and untrusted script sources can materially reduce exploitability of simple reflected payloads. Apply it during regular web hardening work; for this LOW issue there is no accelerated deadline.
4. Put the app behind authentication and reverse proxy rules — Even though the bug itself may be reachable pre-auth, requiring upstream access control and URL inspection reduces who can reach the endpoint and who can be lured. Do this when you next touch the service configuration rather than as an emergency change.

Run this on the target web host, a mounted deployment artifact, or a CI workspace containing the PHP app source. Invoke it as python3 verify_cve_2025_0175.py /var/www/html/online-shop (or the app root on Windows/Linux/macOS); no admin rights are required beyond read access to the application files.

#!/usr/bin/env python3
# verify_cve_2025_0175.py
# Checks whether code-projects Online Shop view.php appears vulnerable to CVE-2025-0175.
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

import os
import re
import sys

VULN_PATTERNS = [
    re.compile(r"echo\s*\(?\s*\$_GET\s*\[\s*['\"]name['\"]\s*\]\s*\)?", re.I),
    re.compile(r"echo\s*\(?\s*\$_GET\s*\[\s*['\"]details['\"]\s*\]\s*\)?", re.I),
]
SAFE_HINTS = [
    re.compile(r"htmlspecialchars\s*\(", re.I),
    re.compile(r"htmlentities\s*\(", re.I),
    re.compile(r"strip_tags\s*\(", re.I),
]

def find_view_php(root):
    if os.path.isfile(root):
        return root if os.path.basename(root).lower() == 'view.php' else None
    for dirpath, _, filenames in os.walk(root):
        for f in filenames:
            if f.lower() == 'view.php':
                return os.path.join(dirpath, f)
    return None

def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2025_0175.py <app_root_or_view.php>")
        sys.exit(2)

    target = sys.argv[1]
    if not os.path.exists(target):
        print(f"UNKNOWN - path does not exist: {target}")
        sys.exit(2)

    view_php = find_view_php(target)
    if not view_php:
        print("UNKNOWN - view.php not found")
        sys.exit(2)

    try:
        with open(view_php, 'r', encoding='utf-8', errors='ignore') as fh:
            content = fh.read()
    except Exception as e:
        print(f"UNKNOWN - cannot read {view_php}: {e}")
        sys.exit(2)

    name_raw = bool(VULN_PATTERNS[0].search(content))
    details_raw = bool(VULN_PATTERNS[1].search(content))
    safe_present = any(p.search(content) for p in SAFE_HINTS)

    # Heuristic result logic:
    # - vulnerable if raw echo for either parameter appears and no obvious output encoding is present.
    # - patched if the file exists and the raw patterns are absent, or if safe encoding wrappers are present around output.
    if (name_raw or details_raw) and not safe_present:
        print(f"VULNERABLE - raw $_GET output found in {view_php}")
        sys.exit(0)
    elif safe_present or (not name_raw and not details_raw):
        print(f"PATCHED - no raw vulnerable sink detected in {view_php}")
        sys.exit(1)
    else:
        print(f"UNKNOWN - manual review required for {view_php}")
        sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. NVD CVE record
2. Public PoC gist by th4s1s
3. code-projects Online Shop download page
4. code-projects Online Shop Store page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Ubuntu CVE page
8. CVE Details entry