Cradle eCommerce Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the latest demo version of the Cradle eCommerce platform. This issue arises because user-controlled input is insecurely reflected in the HTML output on the '/product/' endpoint. Exploiting this vulnerability would allow an attacker to execute arbitrary JavaScript code.

Impact

Exploitation of this vulnerability could lead to the execution of malicious JavaScript in the context of the user's browser, potentially allowing for session hijacking or other malicious actions.

Remediation

The Cradle team has fixed this vulnerability in the latest version of Cradle eCommerce.