CVE-2020-23654

Vulnerability

NavigateCMS 2.9 suffers from a stored cross-site scripting (XSS) vulnerability in the "Shop" module. The application fails to properly sanitize user input when creating products, coupons, brands, shipping methods, or payment methods, allowing injection of arbitrary HTML and JavaScript. The vulnerability is present in all pages under navigate/navigate.php?fid=products, coupons, brands, shipping_methods, and payment_methods. [1]

Exploitation

An authenticated attacker with access to the admin panel can exploit this by navigating to any of the affected Shop submodules and creating a new entry. The attacker inserts a payload such as '><details/open/ontoggle=confirm(1337)> into a text field. Upon saving, the payload is stored and executed when any user (including other administrators) views the affected page, triggering the XSS. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, cookie theft, redirection to malicious sites, or other actions performed under the guise of the vulnerable site. The attack is stored, so it persists until the malicious entry is removed. [1]

Mitigation

As of the publication date (2020-08-26), no official patch has been released for NavigateCMS 2.9. The vendor was notified via the GitHub issue [1]. Users should apply input validation and output encoding to all user-supplied data in the Shop module. If no update is available, consider disabling the Shop module or restricting access to trusted administrators only. [1]