nopCommerce Stored Cross-Site Scripting Vulnerability in Attributes Functionality

A stored cross-site scripting vulnerability has been identified in nopCommerce version 4.90.0. This issue arises within the Attributes management workflow, where an attacker can inject JavaScript into the Name field while creating a new Attribute Group. The vulnerability requires a privileged user to access the 'Specification attributes' page to be exploited.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, navigate to 'Catalog' > 'Attributes' > 'Specification attributes' and select 'Add Group'. In the Name input field, insert a JavaScript payload. Once the group is saved, the injected script will execute when the 'Specification attributes' page is accessed by a privileged user.