SUP Online Shopping EUVD-2026-31589

Exploitation requires the attacker to hold high-privilege administrative credentials for the SUP Online Shopping application (PR:H confirmed by CVSS vector), granting access to the /admin/productedit.php product editing endpoint. The attack is triggered by manipulating the productName parameter with a crafted XSS payload during product creation or editing. Additionally, user interaction is required (UI:P per CVSS): a second authenticated user - such as another admin - must view or render the poisoned product page for the JavaScript to execute. Key limiting factors: the attacker must already be an authenticated high-privilege admin, dramatically narrowing the attacker pool; a victim user must subsequently interact with the injected content; and the impact is bounded to low integrity effects with no confidentiality exposure per the CVSS vector. No non-default configuration is required beyond a functional admin session with access to product editing.

The CVSS 4.0 base score of 1.9 is very low and accurately reflects the constrained attack prerequisites encoded in the vector: high privileges required (PR:H), user interaction required (UI:P), and limited impact - no confidentiality breach (VC:N/SC:N) and only low integrity impact (VI:L/SI:N). An attacker must already hold high-privilege administrative credentials, substantially shrinking the realistic attacker pool to compromised admins or malicious insiders. EPSS at 0.03% (9th percentile) confirms this is not actively sought by opportunistic or mass-scanning threat actors. The publicly available POC (GitHub issue) is a real signal but does not materially elevate risk given the authentication barrier. No CISA KEV listing is present. The CVSS vector is internally consistent with the description - the admin-only attack surface logically requires high privileges. Overall, this is a low real-world priority: the attacker already has more destructive administrative capabilities than XSS provides, limiting meaningful adversarial leverage beyond session hijacking within the same privilege tier.

An attacker who has obtained high-privilege admin credentials - through phishing, credential stuffing, or insider access - logs into the SUP Online Shopping admin panel and navigates to /admin/productedit.php, injecting a JavaScript payload such as an alert or cookie-stealing script into the productName field. When a second authenticated admin user subsequently views or edits the poisoned product entry, the script executes in their browser session, potentially exfiltrating their session cookie or performing unauthorized actions within the admin panel on their behalf. A publicly available POC documenting these steps is referenced at https://github.com/redshadowword-cell/CVE/issues/13.