Description

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T21:17:51.660Z",
  "pubdate": "2026-08-31T21:17:51.660Z",
  "executiveSummary": "Super Store Finder versions 7.10 and below are susceptible to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability exists due to improper input sanitization of user-supplied data before rendering it within the application's browser-side output.\nThe flaw allows remote, unauthenticated attackers to inject arbitrary malicious scripts, such as JavaScript, into the victim's browser session.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or the redirection of users to malicious third-party domains.\nThe vulnerability does not require authentication, significantly lowering the barrier for exploitation by remote actors.\nThe risk is categorized as high, as it impacts the integrity and confidentiality of client-side user sessions.\nThe flaw affects the product's rendering logic, necessitating immediate mitigation to prevent unauthorized script execution in the context of the user's browser.",
  "technicalDetails": "The vulnerability is identified as a Reflected Cross-Site Scripting (XSS) flaw located within the Super Store Finder application, specifically affecting versions 7.10 and below.\nThe root cause of this vulnerability is the insufficient validation and sanitization of HTTP request parameters. The application fails to properly encode or escape input data before reflecting it back to the client-side user interface.\nIn a typical attack vector, an attacker crafts a malicious URL containing a payload within a vulnerable parameter. When an unsuspecting authenticated user, such as an administrator, clicks the link, the application processes the input and embeds the malicious script directly into the HTML response.\nThe browser executes this injected script in the context of the application's origin. Because the script runs within the victim's session, it inherits the victim's privileges.\nThe attack flow follows these steps: First, the attacker identifies the injection point by manipulating query string parameters that are echoed back in the response page. Second, the attacker encodes a malicious JavaScript payload (e.g., document.cookie extraction or forced HTTP requests). Third, the attacker distributes the link via social engineering or other vectors. Finally, the victim interacts with the link, triggering the script execution in their browser environment.\nAs this is an unauthenticated vulnerability, no prior access or account privileges are required to initiate the attack. The attack surface is exposed directly through the web interface, making it accessible to any remote user with network access to the target instance.\nThe impact of successful exploitation includes, but is not limited to: the theft of session cookies, which could allow the attacker to hijack the user's account; the bypass of CSRF protections; the execution of unauthorized administrative actions; and the potential for defacement or phishing attacks against users.\nThe vulnerability persists in all versions up to and including 7.10, indicating a systemic failure in the application's input handling and output encoding mechanisms."
}