PEEL Shopping Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in PEEL Shopping version 9.3.0. The issue resides in the address parameter of the change_params.php script, allowing attackers to inject malicious JavaScript payloads. These payloads are executed when users interact with the address text box, potentially leading to client-side script execution.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, inject a JavaScript payload into the address parameter of the change_params.php script. After injection, click on the text box to edit the address. The injected JavaScript will execute, demonstrating the cross-site scripting vulnerability.