Platform
php
Component
bb6781e5977bda36610fda20861a5bbe
Opgelost in
1.0.1
CVE-2025-9237 is a cross-site scripting (XSS) vulnerability discovered in CodeAstro Ecommerce Website version 1.0. This flaw allows attackers to inject malicious scripts into the application, potentially compromising user accounts and data. The vulnerability resides in the /customer/myaccount.php?editaccount file, specifically the Username parameter. A patch is available in version 1.0.1.
Successful exploitation of CVE-2025-9237 allows an attacker to inject arbitrary JavaScript code into the CodeAstro Ecommerce Website. This can be used to steal user session cookies, redirect users to malicious websites, or deface the website. The impact is heightened because the vulnerability is remotely exploitable and the exploit is publicly available. Attackers could leverage this to gain unauthorized access to user accounts, potentially leading to data theft or further compromise of the e-commerce platform. The blast radius extends to all users who interact with the affected 'Edit Your Account' page.
The exploit for CVE-2025-9237 has been publicly disclosed, increasing the likelihood of exploitation. The vulnerability is rated LOW severity based on the CVSS score. As of the publication date, there's no indication of active exploitation campaigns targeting this specific vulnerability, but the public availability of the exploit means it could be incorporated into automated scanning tools or exploited by less sophisticated attackers. This CVE was published on 2025-08-20.
E-commerce businesses using CodeAstro Ecommerce Website version 1.0 are at direct risk. Shared hosting environments where multiple websites share the same server are particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others. Users who frequently update their account information through the 'Edit Your Account' page are also at higher risk.
• php / web:
curl -s -X POST "http://your-website.com/customer/my_account.php?edit_account" -d "Username=<script>alert('XSS')</script>" | grep -i alert• generic web:
curl -I http://your-website.com/customer/my_account.php?edit_account&Username=<script>alert('XSS')</script>• generic web: Examine access logs for requests to /customer/myaccount.php?editaccount containing suspicious characters or script tags in the Username parameter.
disclosure
Exploit Status
EPSS
0.05% (14% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2025-9237 is to upgrade CodeAstro Ecommerce Website to version 1.0.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on the Username parameter in the /customer/my_account.php file. This can help prevent malicious scripts from being injected. While a WAF might offer some protection, it's not a substitute for patching the vulnerability. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the Username parameter and verifying that it is properly sanitized.
Werk CodeAstro Ecommerce Website bij naar een gepatchte versie die de XSS-kwetsbaarheid oplost. Indien er geen versie beschikbaar is, controleer en filter dan de gebruikersinvoer in het bestand /customer/my_account.php?edit_account, met name de parameter Username, om de injectie van kwaadaardige code te voorkomen. Implementeer data validatie en sanitatie aan de serverzijde om XSS-aanvallen te voorkomen.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2025-9237 is a cross-site scripting (XSS) vulnerability affecting CodeAstro Ecommerce Website version 1.0, allowing attackers to inject malicious scripts via the Username parameter in the edit account page.
You are affected if you are using CodeAstro Ecommerce Website version 1.0. Upgrade to version 1.0.1 or later to mitigate the risk.
Upgrade CodeAstro Ecommerce Website to version 1.0.1 or later. As a temporary workaround, implement input validation and output encoding on the Username parameter.
While there's no confirmed active exploitation, the exploit is publicly available, increasing the risk of exploitation.
Refer to the CodeAstro website or their official security advisory channels for the latest information regarding CVE-2025-9237.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.