cve-xss-contact-shop.md

Affected Version:

• Online Eyewear Shop Website: 1.0

Vulnerability Information:

• Vulnerability Type: Stored Cross-Site Scripting (XSS)
• Severity: HIGH
• Status: Unpatched

Vulnerable URL:

• admin/?page=system_info/contact_info

Vulnerability Description:

A stored XSS vulnerability has been identified in the Online Eyewear Shop Website version 1.0. This flaw is located in the contact form update section of the admin panel, which allows administrators to modify the website's contact information. An attacker can inject malicious JavaScript code into the form fields. Once stored, the payload is executed every time the page is accessed, which could lead to session hijacking, the theft of sensitive information, or privilege escalation affecting both users and administrators.

Proof of Concept (PoC):

Below is an example of a malicious payload:

<script>alert('XSS');</script>

This script, when injected into the contact form, will trigger the alert each time the page is accessed, demonstrating the vulnerability. Similar payloads could be used for more dangerous actions, such as session theft or data manipulation.

XSS Example:

• 
• 
• 

External Links:

• Vulnerability Source