Technical impact
The vulnerability resides in the XssHttpServletRequestWrapper class of Shopizer 3.2.5 and allows an authenticated user to insert malicious JavaScript or arbitrary HTML through the getInputStream() or getReader() interfaces. By controlling the payload delivered to these methods, an attacker can execute scripts in the context of the web application, leading to credential theft, session hijacking, defacement, or the delivery of malware to end users.
Affected Systems
Shopizer eCommerce platform version 3.2.5 is affected. All installations of this version that expose the vulnerable request wrapper to authenticated users are at risk.
Risk and Exploitability
An attacker must first authenticate to the system to exploit the flaw, after which they can inject malicious content that will be rendered when the input streams are processed. While EPSS data and KEV status are not available, the CVSS score of 5.4 indicates a medium severity, yet the nature of the flaw provides an attacker with the ability to execute arbitrary scripts, implying a significant threat to confidentiality and integrity of user data.
Github GHSA