PHPGurukul Online Shopping Portal Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in PHPGurukul Online Shopping Portal version 2.1. The issue resides in the admin update order functionality, specifically within the updateorder.php file. This vulnerability allows attackers to inject and execute arbitrary JavaScript in the context of the user's session, potentially leading to account takeover.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, install PHPGurukul Online Shopping Portal version 2.1 on a local server. Log in using the default admin credentials. Navigate to the updateorder.php page in the admin panel, and inject a script tag containing JavaScript, such as an alert, into the content field. Select the 'In Process' status and click 'Update'. The injected script will be executed, demonstrating the cross-site scripting vulnerability.