Executive brief
EverShop is an e-commerce platform used to build online stores. A security flaw in how the platform handles product sorting requests allows attackers to inject malicious scripts into the web pages seen by other users. If a victim clicks a specially crafted link, an attacker could potentially steal sensitive session information or perform actions on the user's behalf.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in EverShop versions prior to 1.0.0-rc.8. The vulnerability is located in the handling of the 'sortBy' parameter. By providing a second 'sortBy' parameter in a crafted HTTP request, an attacker can bypass existing input validation, causing the application to reflect the unsanitized second value back into the page's HTML. This can be exploited by a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of a user's browser session, provided the user interacts with a malicious link. The issue is addressed in version 1.0.0-rc.8.
Affected products
- EverShop evershop < 1.0.0-rc.8
Timeline
- 2023-09-26: patched: Fix merged in pull request 338
- 2023-12-08: disclosed: NVD publication date
- 2023-12-08: advisory: GitHub Advisory published