Cradle eCommerce EUVD-2026-28545

User interaction is REQUIRED - the victim must click the attacker-controlled link containing the malicious 'returnUrl' parameter and complete the login process. The vulnerability is present in the latest demo version of Cradle eCommerce without any indication of special configuration or feature enablement required; it affects the default login endpoint. LIMITING FACTORS: (1) The attack depends on social engineering (phishing email, forum post, etc.) to trick users into clicking the malicious link - mass automated exploitation is not feasible. (2) The attacker must know or guess a legitimate Cradle eCommerce login URL. (3) The user must not manually verify the post-login redirect destination, which may trigger alerts in security-aware users. (4) The vulnerability is currently documented only in demo/test versions; applicability to production Cradle instances is unconfirmed.

Risk signals are mixed and weighted toward LOW real-world priority. CVSS 5.3 with network vector (AV:N) and no privilege requirement (PR:N) suggests network accessibility, but mandatory user interaction (UI:P) significantly limits attack surface - the user must click the malicious link themselves. EPSS score of 0.04% (12th percentile) indicates very low exploitation probability in the wild, contradicting the moderate CVSS rating. SSVC framework reinforces this: exploitation is listed as 'none' (not observed), automation is 'no' (social engineering required per-target), and technical impact is only 'partial' (redirection alone does not achieve code execution or data breach without follow-up attack). No CISA KEV listing or public POC identified. The combination of UI:P requirement and low EPSS suggests this is primarily a social engineering vector with limited appeal to automated attackers. Organizations should remediate but should not prioritize this above network-accessible critical/high CVSS flaws with AV:N/AC:L/PR:N/UI:N profiles.

An attacker crafts a phishing URL: 'https://cradle-shop.example.com/login?returnUrl=https://attacker.com/fake-login' and sends it to users via email. When a user clicks the link and logs in at the legitimate site, the application automatically redirects them to the attacker's phishing page, which mimics the legitimate post-login experience and harvests session tokens or additional credentials. This attack is effective because the initial domain is trusted.