Smart E Commerce
Monthly
Reflected cross-site scripting in IdeaSoft Smart E-Commerce through version 11092026 allows remote unauthenticated attackers to inject malicious JavaScript into HTTP responses delivered to victim browsers. Exploitation requires social engineering a user into clicking a crafted URL, after which the injected script executes in the context of the e-commerce application's origin, enabling session hijacking, credential theft, or unauthorized actions. Vendor-released patch is not available - IdeaSoft did not respond to TR-CERT's coordinated disclosure attempt, leaving all deployments on the affected version without an official fix.
Reflected cross-site scripting in IdeaSoft Smart E-Commerce through version 11092026 allows remote unauthenticated attackers to inject malicious JavaScript into HTTP responses delivered to victim browsers. Exploitation requires social engineering a user into clicking a crafted URL, after which the injected script executes in the context of the e-commerce application's origin, enabling session hijacking, credential theft, or unauthorized actions. Vendor-released patch is not available - IdeaSoft did not respond to TR-CERT's coordinated disclosure attempt, leaving all deployments on the affected version without an official fix.