Executive Summary

This vulnerability is a persistent cross-site scripting (XSS) flaw in the Sellacious eCommerce 4.6 software, specifically in the 'Manage Your Addresses' module. Attackers can inject malicious scripts into multiple address input fields such as full name, company, and address by registering a low-privilege user account and submitting crafted POST requests. These malicious scripts are stored on the server and execute whenever the affected address information is displayed in the web application's user interface, allowing attackers to hijack user sessions and manipulate application modules. [1, 4]

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to session hijacking, persistent phishing attacks, external redirects to malicious websites, and manipulation of application modules. Because the malicious scripts persist and execute whenever the compromised address data is viewed, attackers can continuously compromise users interacting with the application, potentially stealing sensitive information or disrupting normal operations. [1, 4]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to inject malicious script payloads into the address input fields (such as full name, company, address, PO Box, landmark) via POST requests to the 'Manage Your Addresses' module (e.g., index.php/manage-your-addresses). You can test by submitting payloads like <script>alert(document.cookie)</script> or iframe elements in these fields and then checking if the script executes when the address data is displayed in the web UI. Commands to test this might include using curl to POST data with script payloads to the address management endpoint, for example: curl -X POST -d "full_name=<script>alert(1)</script>&company=test" https://your-sellacious-site/index.php/manage-your-addresses. Monitoring web application responses for script execution or unexpected behavior can confirm the vulnerability. [1, 4]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling the 'Manage Your Addresses' module to prevent input of malicious scripts, applying proper input validation and sanitization on all address input fields to block script injection, and updating the Sellacious eCommerce software if a patch is available. Additionally, monitor user inputs for suspicious content and consider implementing web application firewall (WAF) rules to detect and block XSS payloads targeting these fields. [1, 4]

Useful 0 Not Useful 0