Executive brief
Ecommerce Fruits Bazar, an online shopping platform, contains a security flaw in its administrative product management interface. An attacker could use this vulnerability to inject malicious scripts into the product editing page. If an administrator views the affected page, the attacker could potentially hijack their session, steal sensitive credentials, or perform unauthorized actions within the store management system.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Ecommerce Fruits Bazar 1.0 within the 'admin/edit_product.php' script. The application fails to properly sanitize user-supplied input before rendering it in the administrative interface. An attacker with access to product modification features (or via a CSRF-style delivery) can inject arbitrary JavaScript. When an authenticated administrator accesses the compromised product entry, the script executes in the context of their browser session. This can lead to session token theft, unauthorized administrative actions, or redirection to malicious sites.
Affected products
- Ecommerce Fruits Bazar Ecommerce Fruits Bazar 1.0
Timeline
- 2026-07-30: disclosed: Initial CVE publication date