ActiveITzone Active Super Shop CMS Manage Details Page cross site scripting

Vulnerability

A problematic vulnerability, classified as cross-site scripting (XSS), exists in ActiveITzone Active Super Shop CMS version 2.5. The flaw affects the Manage Details Page, where the name, phone, and address parameters are not properly sanitized before being stored and later presented to users [1]. This allows an attacker to inject malicious HTML or JavaScript code that will execute in the context of other users' browsers when the stored data is rendered.

Exploitation

An attacker with network access to the application can initiate the attack remotely without requiring authentication [1]. By crafting a POST request to the /shop/admin/manage_admin/update_profile/ endpoint, the attacker includes malicious payloads (e.g., `) within the name, phone, or address` fields. The PoC demonstrated in advisory [1] shows a successful attack by submitting the payload through a standard HTTP POST. The attack does not require any user interaction beyond the victim later viewing the affected admin profile page, where the stored script will execute automatically.

Impact

Successful exploitation results in arbitrary script execution within the context of the vulnerable application [1]. An attacker can use this to steal session cookies, redirect users to malicious sites, deface pages, or perform actions on behalf of an authenticated admin user. The security risk is estimated as medium by the discoverer [1], but the attacker's capabilities depend on the privileges of the user viewing the injected content.

Mitigation

As of the publication date (2023-07-20), no official patch from ActiveITzone has been announced [1]. The vendor's advisory recommends manually disallowing HTML code insertion for input fields and properly sanitizing the content to secure delivery [1]. A temporary workaround is to implement input validation and output encoding for the name, phone, and address parameters until a vendor-supplied fix becomes available.