Abhicodebox ModernShop Cross-Site Scripting Vulnerability in Search Functionality

A cross-site scripting (XSS) vulnerability has been identified in Abhicodebox ModernShop version 20250922. The issue arises in the search feature, specifically within the file '/search'. By manipulating the 'q' parameter, remote attackers can inject malicious scripts. This vulnerability has been publicly disclosed and is accompanied by a proof-of-concept exploit.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the '/search' endpoint with a crafted 'q' parameter that includes script tags. The injected script will be executed, demonstrating the cross-site scripting vulnerability.