PEEL Shopping Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in PEEL Shopping version 9.3.0. The issue resides in the 'Comments / Special Instructions' parameter on the purchase page. This vulnerability allows attackers to inject malicious JavaScript payloads that execute when the page is refreshed, potentially leading to unauthorized client-side script execution.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the purchase page of PEEL Shopping 9.3.0. Inject a JavaScript payload into the 'Comments / Special Instructions' parameter. After submitting the injection, refresh the page to observe the execution of the injected script.