CVE-2017-17929

Vulnerability

The Professional Service Script by PHP Scripts Mall contains a reflected Cross-Site Scripting (XSS) vulnerability in the admin/bannerview.php file. The view parameter is not properly sanitized, allowing an attacker to inject arbitrary HTML and JavaScript code. The vulnerability affects the latest version as of December 2017 (no specific version provided). [1]

Exploitation

An attacker can craft a malicious URL such as http://ordermanagementscript.com/demo/professional-service/admin/bannerview.php?view=27%27%22%3E666%3Cimg%20src=x%20onerror=console.log(document.cookie)%3E666%3C%27%22 and trick a logged-in admin into clicking it. The injected script executes in the context of the admin's browser session. No authentication is required beyond the admin's existing session. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the admin's browser. This can lead to session hijacking, theft of sensitive data (e.g., cookies), defacement of the admin interface, or further attacks leveraging the admin's privileges. The attack scope is limited to the admin panel but could compromise the entire application if the admin's session is stolen. [1]

Mitigation

No official fix or patch has been released by the vendor as of the publication date. The only workaround is to manually sanitize the view parameter in admin/bannerview.php by escaping or validating input. Alternatively, restrict access to the admin panel to trusted users. [1]