CodeAstro Ecommerce Website Editar sua conta my_account.php cross site scripting

Successful exploitation of CVE-2025-9237 allows an attacker to inject arbitrary JavaScript code into the CodeAstro Ecommerce Website. This can be used to steal user session cookies, redirect users to malicious websites, or deface the website. The impact is heightened because the vulnerability is remotely exploitable and the exploit is publicly available. Attackers could leverage this to gain unauthorized access to user accounts, potentially leading to data theft or further compromise of the e-commerce platform. The blast radius extends to all users who interact with the affected 'Edit Your Account' page.

E-commerce businesses using CodeAstro Ecommerce Website version 1.0 are at direct risk. Shared hosting environments where multiple websites share the same server are particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others. Users who frequently update their account information through the 'Edit Your Account' page are also at higher risk.

• php / web:

curl -s -X POST "http://your-website.com/customer/my_account.php?edit_account" -d "Username=<script>alert('XSS')</script>" | grep -i alert

• generic web:

curl -I http://your-website.com/customer/my_account.php?edit_account&Username=<script>alert('XSS')</script>

• generic web: Examine access logs for requests to /customer/myaccount.php?editaccount containing suspicious characters or script tags in the Username parameter.

1. 2025-08-20Disclosure

   disclosure

1. Reservado2025-08-20
2. Publicada2025-08-20
3. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-9237 is to upgrade CodeAstro Ecommerce Website to version 1.0.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on the Username parameter in the /customer/my_account.php file. This can help prevent malicious scripts from being injected. While a WAF might offer some protection, it's not a substitute for patching the vulnerability. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the Username parameter and verifying that it is properly sanitized.