A stored cross-site scripting vulnerability in PEEL Shopping 9.3.0 allows authenticated attackers to execute malicious JavaScript, potentially leading to session hijacking or unauthorized actions.

This vulnerability is a stored cross-site scripting flaw located in the Comments or Special Instructions parameter of the purchase page. An authenticated user can inject malicious scripts that execute in the context of the user's browser whenever the page is refreshed.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of other users, including administrators. This can lead to the theft of session cookies, redirection to malicious websites, or the performance of unauthorized actions on behalf of the victim, potentially resulting in full account compromise. While the CVSS score of 7.2 reflects a high risk, the requirement for user interaction and authentication limits the overall impact compared to unauthenticated remote code execution.

Immediate Action: Upgrade to the latest available version of PEEL Shopping that addresses this vulnerability. If an update is not immediately available, restrict access to the purchase page to trusted users.

Proactive Monitoring: Review application access logs for suspicious payloads within the Comments or Special Instructions fields. Monitor for unusual client-side behavior or unauthorized changes to account settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common cross-site scripting patterns in HTTP POST requests. Ensure that Content Security Policy (CSP) headers are implemented to restrict the sources from which scripts can be executed.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49574).

Given the availability of a public proof-of-concept and the nature of stored cross-site scripting, organizations utilizing PEEL Shopping 9.3.0 should prioritize patching. If immediate remediation is not feasible, implement strict input validation and sanitization filters on the affected parameter to prevent the injection of malicious scripts.