| शीर्षक | ShopXO 6.5.0 Cross Site Scripting |
|---|
| विवरण | Summary
A Reflected Cross-Site Scripting (XSS) vulnerability exists in ShopXO 6.5.0, affecting multiple template files (header.html and is_header.html) across different modules. The issue arises due to insufficient input sanitization of the system_type parameter, allowing attackers to inject arbitrary JavaScript via a crafted URL.
Details
Insufficient Sanitization in Template Files:
The system_type parameter is passed directly into JavaScript without proper escaping for single quotes (').
While htmlentities() is applied, it does not prevent JavaScript injection when the value is used inside a JavaScript string context.
Vulnerable Code Locations:
app/admin/view/default/lib/is_header.html
app/admin/view/default/public/header.html
app/index/view/default/lib/is_header.html
app/index/view/default/public/header.html
app/install/view/public/header.html
Vulnerable Code Snippet:
<script>
var __system_type__ = '<?php echo htmlentities((string) $system_type); ?>';
Proof of Concept (PoC)
http://target-ip/?s=user/modallogininfo&system_type=1%27;alert(document.cookie);var%20__test__=%271 |
|---|
| स्रोत | ⚠️ https://github.com/gongfuxiang/shopxo/issues/88 |
|---|
| उपयोगकर्ता | jiashenghe (UID 39445) |
|---|
| सबमिशन | 01/07/2025 06:07 AM (1 वर्ष पहले) |
|---|
| संयम | 13/07/2025 09:05 AM (12 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 316265 [ShopXO तक 6.5.0 header.html lang/system_type क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|