A stored cross-site scripting vulnerability in PEEL Shopping 9.3.0 allows authenticated attackers to execute malicious scripts, posing a risk of session hijacking and unauthorized actions.

This vulnerability is a stored cross-site scripting (XSS) flaw located in the address parameter of the change_params.php script. The vulnerability requires a low-privileged authenticated user to trigger the malicious payload, which executes when a user interacts with the compromised input field.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to the theft of session cookies, account takeover, or the redirection of users to malicious sites, significantly impacting user privacy and system integrity. While the CVSS score of 7.2 reflects a high severity, the impact is primarily focused on client-side compromise rather than direct server-side code execution.

Immediate Action: Since no official patch is currently identified, users should audit their implementations and restrict access to account management features. If possible, migrate to a supported version or alternative platform if the vendor has deprecated this specific release.

Proactive Monitoring: Monitor web server logs for suspicious activity, specifically looking for unusual characters or script tags being submitted to the change_params.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block XSS patterns in HTTP requests, specifically targeting the address parameter to neutralize potential payloads.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented on Exploit-DB (EDB-ID 49553).

Given the availability of a public proof-of-concept and the nature of stored XSS, organizations should treat this vulnerability with urgency. Implement strict input validation and output encoding for all user-supplied data in the address field to prevent script execution, while prioritizing the transition to a modern, supported version of the software.