CVE-2025-7567
Description
A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/system_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A reflected XSS vulnerability in ShopXO ≤6.5.0 allows remote attackers to inject arbitrary JavaScript via the `lang` parameter in header.html.
The vulnerability stems from insufficient input sanitization in ShopXO’s multilingual support functionality. The lang parameter value is directly embedded into a JavaScript variable assignment without proper escaping of single quotes. This occurs in the header.html files of the app, admin, and install views [1].
An attacker can trigger the flaw by sending a crafted link containing a malicious lang parameter to a user, such as http://target-ip/?lang=1%27;alert(234);var%20__test__=%271. No authentication is required for the public-facing entry point, making it remotely exploitable [1].
The impact includes potential session hijacking (by stealing admin/user cookies), phishing attacks (by injecting fake login forms), and, if the backend is targeted, privilege escalation through modification of administrative settings [1].
ShopXO versions up to and including 6.5.0 are affected. The vendor has not released a patch at the time of this writing. Users should either sanitize the lang parameter in the vulnerable templates or restrict access to the header files until an official fix is available [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=6.5.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5News mentions
0No linked articles in our index yet.