nopCommerce Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in nopCommerce version 4.40.3. The issue resides in the Product Name field within the admin product editing interface. When a product is viewed in the shop, the injected XSS payload is executed, potentially harming users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the product.

Reproduction

To reproduce this vulnerability, log in as an admin and navigate to the product editing page. In the Product Name field, enter a payload that includes an SVG element with an onload event, such as one that uses JavaScript to access the alert function. After saving the product, visit the product page in the shop frontend to see the payload execute.