Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-28T16:18:13.490Z",
  "pubdate": "2026-08-28T16:18:13.490Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the Akilli Ticaret Software Technologies Ltd. E-Commerce Pack, spanning versions 4.5.001 through 28082026. This flaw is classified under improper neutralization of input during web page generation (CWE-79).\nThe vulnerability allows unauthenticated or authenticated attackers to inject malicious client-side scripts—typically JavaScript—into the application's persistent storage (such as database fields or backend content management interfaces). Once the malicious payload is stored, it is executed automatically in the browser of any user who accesses the compromised page.\nThe impact is critical, as it facilitates unauthorized actions on behalf of the victim, session hijacking via cookie theft, redirection to malicious domains, or defacement of the e-commerce storefront. Given that the vendor has remained unresponsive to disclosure attempts, the risk to deployments is elevated due to the lack of official security patches. Organizations utilizing this software are currently exposed, and immediate defensive measures must be prioritized to prevent exploitation by remote threat actors.",
  "technicalDetails": "The vulnerability originates from the application's failure to sanitize, validate, or encode user-supplied data before persisting it in the backend database and subsequently rendering it within the web interface. This constitutes a classic Stored XSS vector, where the malicious input is permanently stored by the target application.\nThe attack flow begins when an attacker identifies an input vector within the E-Commerce Pack that does not enforce strict input validation—such as user profile fields, product review sections, contact forms, or administrative input fields. The attacker crafts a payload containing HTML/JavaScript tags (e.g., <script>alert(document.cookie)</script>).\nUpon submission, the application accepts this payload and commits it to the database without appropriate context-aware output encoding. When the vulnerable component retrieves this data for display to a legitimate user or an administrator, the browser parses the payload as active content. Because the script originates from the application's own origin, the browser executes the code within the security context of the session, bypassing standard Same-Origin Policy (SOP) protections.\nThe exploitation process typically follows these steps: 1) Identification of persistent input fields that are rendered without output escaping. 2) Injection of a malicious payload designed to interact with the Document Object Model (DOM) or exfiltrate sensitive data. 3) Storing the payload, which allows for asynchronous execution when the victim views the affected record. 4) Triggering the payload execution in the context of the victim's session.\nThe post-exploitation impact is significant. If an administrator views the stored payload, the attacker could potentially leverage XSS to create new administrative accounts, modify system configurations, or exfiltrate sensitive customer order data. For general users, the payload can be utilized to hijack authentication tokens stored in `HttpOnly` or non-`HttpOnly` cookies, enabling full account takeover. Since the application handles e-commerce transactions, the risk includes the potential interception of payment-related data or session hijacking of authenticated payment workflows. Given that the vendor is unresponsive, there is no inherent patch mechanism, necessitating manual intervention by system administrators to sanitize inputs at the application layer or implement robust Content Security Policy (CSP) headers to restrict script execution."
}