Executive Summary

CVE-2021-47892 is a stored cross-site scripting (XSS) vulnerability in PEEL Shopping version 9.3.0. It exists in the 'Comments / Special Instructions' parameter on the purchase page, where attackers can inject malicious JavaScript code. This code is stored on the server and executed whenever the affected page is refreshed, allowing client-side script execution. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious JavaScript in the context of the affected website. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions performed on behalf of the user. Since the malicious script executes when the page is refreshed, it can repeatedly affect users visiting the page. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to inject a JavaScript payload into the 'Comments / Special Instructions' field on the purchase page located at `/achat/achat_maintenant.php`. For example, you can submit a payload with an event handler such as `onload` or `onclick` that triggers an alert box. After submitting, refresh the page to see if the JavaScript executes, confirming the presence of the stored XSS vulnerability. Specific commands depend on your testing environment, but a common approach is to use curl or a browser-based tool to POST data to the purchase page with the malicious payload in the comments field and then check the page response for script execution. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and validating all user inputs on the 'Comments / Special Instructions' field to prevent injection of malicious scripts. Implement proper output encoding to neutralize any injected scripts before rendering them on the page. Additionally, consider applying web application firewall (WAF) rules to detect and block suspicious input patterns. If possible, update or patch PEEL Shopping to a version where this vulnerability is fixed. Until a patch is available, restrict user input or disable the vulnerable input field to prevent exploitation. [2]

Useful 0 Not Useful 0