CVE-2022-27168

Vulnerability

LiteCart versions prior to 2.4.2 are vulnerable to a stored cross-site scripting (XSS) issue. The flaw exists in the admin order editing interface where user-supplied input from $_POST['comments'][$key]['text'] and $_POST['items'][$key]['name'] is echoed without HTML escaping [2]. This allows an attacker to inject arbitrary JavaScript or HTML that is stored and later executed in the context of an administrator's browser session.

Exploitation

An attacker can exploit this vulnerability by submitting crafted input through the order comment or item name fields. No authentication is required if the attacker can submit data via a form that is processed by the vulnerable endpoint (e.g., via a direct POST request). The injected script is stored in the database and executed when an administrator views the affected order page in the admin panel [1]. The attack requires user interaction (the admin viewing the page) but no special privileges beyond the ability to submit data.

Impact

Successful exploitation allows an attacker to execute arbitrary scripts in the web browser of an authenticated administrator. This can lead to session hijacking, theft of sensitive data (e.g., customer information, admin credentials), defacement, or further attacks against the e-commerce platform. The CVSS v3 score is 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [1].

Mitigation

The vulnerability is fixed in LiteCart version 2.4.2, released on or before July 4, 2022 [1]. The fix is implemented in commit 050fea86cc162f3da2f7824f586602125a0f6d63, which applies functions::escape_html() to the affected output fields [2]. Users should upgrade to the latest version immediately. No workarounds are documented; if upgrading is not possible, administrators should restrict access to the admin panel and avoid viewing orders from untrusted sources.