Stored Cross-Site Scripting Vulnerability in Shopizer by Shopizer
CVE-2021-33561

4.8MEDIUM

Key Information:

Vendor

Shopizer

Status
Shopizer
Vendor
CVE Published:
24 May 2021

Badges

👾 Exploit Exists

What is CVE-2021-33561?

A stored cross-site scripting (XSS) vulnerability exists in Shopizer versions before 2.17.0, enabling remote attackers to inject arbitrary web scripts or HTML into store administration forms. This attack uses the 'customer_name' field, with malicious payloads being saved in the database. Upon retrieving this information in the backend, such as within admin/customers/list.html, the injected scripts are executed for any user accessing the administration panel, posing a significant security risk.

References

https://github.com/shopizer-ecommerce/shopizer/commit/197...
x_refsource_MISC
https://www.exploit-db.com/exploits/49901
x_refsource_MISC
https://github.com/shopizer-ecommerce/shopizer/compare/2....
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.