ezWaiter v3.0=0D
=0D
Homepage:=0D
http://www.ezwaiter.com/=0D 
=0D
Affected files:=0D
=0D
Placing an order=0D
login.php=0D
-------------------------------------------=0D
=0D
XSS vuln when placing an order:=0D
=0D
User input is not sanatized before being generated. For a PoC in the two boxes labeled=0D
"Who is this item for?" and "Special Instructions:"=0D
=0D
put:=0D
=0D
=0D 
=0D
The login form found on login.php can be spoofed to remove the max char limits. It too doesn't sanatize data.=0D
=0D
---------------------------------------=0D