Executive brief
TechStore is a web application that manages product catalogs and customer contacts. A reflected cross-site scripting (XSS) vulnerability in the contact_display function allows attackers to inject malicious JavaScript into the page by crafting a malicious link. When a logged-in user clicks the link, the attacker's script runs with full user privileges, enabling session theft, unauthorized account actions, and credential harvesting.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the contact_display endpoint of TechStore v1.0. The id GET parameter is echoed directly into the HTML response body without output encoding or server-side validation, allowing attackers to inject arbitrary HTML and JavaScript. The attack requires network access (no authentication) but demands user interaction—a victim must click a crafted link while logged in. An attacker can steal session cookies, perform unauthorized actions on behalf of the victim, or deliver secondary malicious payloads. There are no known public patches; remediation requires HTML-entity encoding of user input and server-side validation (e.g., numeric-only whitelist).
Affected products
- nooncarlett TechStore 1.0
Timeline
- 2026-08-31: disclosed
- 2026-08-28: other: Vulnerability writeup published