Executive brief
Exrick xmall is an open-source e-commerce platform with a front-end storefront and back-end order management system. A vulnerability in the order printing component allows an attacker to inject malicious code into order fields (recipient address and product name) when creating an order; when back-office staff print or view these orders, the attacker's code executes in their browser, potentially compromising staff sessions and order integrity.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the order printing module. The attack vector originates from the front-end order creation API (POST /member/addOrder), where user-controlled fields including streetName and goodsList[*].productName are accepted and persisted to the database without sanitization. Back-office staff retrieve orders via GET /order/detail/{orderId} and render these fields directly into HTML via jQuery's .html() method and string concatenation in the order-print.jsp template, bypassing XSS protections. An attacker with access to the front-end API can craft malicious orders; when authenticated back-office staff view these orders, the payload executes in their privileged context. The front-end API lacks proper authorization checks (only validates that a userId exists in the member table). Fixes should include using .text() or textContent for rendering text fields, validating and sanitizing input, and reconstructing product names server-side from product IDs rather than trusting user-supplied values.
Affected products
- Exrick xmall up to commit 19e7917d5ed3bd2a2421a3a246ad494c133ba94c (rolling release, no version tags)
Timeline
- 2026-08-01: disclosed: Vulnerability reported via GitHub issue #104
- 2026-09-13: advisory: CVE-2026-90571 published