Description

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-13T17:16:58.157Z",
  "pubdate": "2026-09-13T17:16:58.157Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in the Order Printing component of Exrick xmall, specifically within the xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp file.\nThis vulnerability stems from the improper neutralization of user-supplied input before rendering it in the browser, allowing an attacker to inject and execute arbitrary JavaScript code within the context of a victim's session.\nImpacted systems include Exrick xmall versions up to commit 19e7917d5ed3bd2a2421a3a246ad494c133ba94c.\nThe flaw allows for remote exploitation, potentially enabling an attacker to hijack user sessions, access sensitive information, or perform unauthorized actions on behalf of the victim.\nSuccessful exploitation generally requires the attacker to entice an authenticated or authorized user to interact with a malicious link or specifically crafted request.\nGiven the nature of the application and the lack of vendor response to reported issues, the risk remains unmitigated for existing deployments, necessitating proactive manual intervention by administrators.",
  "technicalDetails": "The vulnerability is localized within the xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp file, which is responsible for handling order printing tasks. The root cause of the vulnerability is the application's failure to perform adequate input validation and context-aware output encoding when processing parameters for order rendering.\nIn a web application environment, XSS occurs when an application includes untrusted data in a web page without proper validation or escaping. In this instance, user-supplied data provided to the Order Printing module is directly reflected back to the client-side environment. Because the application fails to sanitize this input—treating it as executable HTML or script content rather than plain text—a malicious actor can inject arbitrary JavaScript.\nThe attack flow typically involves the attacker crafting a malicious payload, such as a script tag or an HTML attribute containing an event handler (e.g., onload, onerror). This payload is delivered to the xmall-manager-web application via the vulnerable parameter handled by order-print.jsp. Once the application processes this input and renders it in the victim’s browser, the embedded script executes within the context of the origin where the vulnerable script is hosted. This grants the script access to the Document Object Model (DOM), browser storage (including cookies and local storage), and the ability to perform background HTTP requests.\nThe vulnerability is remotely exploitable, meaning an attacker does not require physical access to the server. The execution happens entirely on the client side, leveraging the trust the browser has in the origin of the xmall application. Since the vulnerability resides within the JSP file responsible for processing order details, any user authorized to access the order printing interface may be targeted. The impact post-exploitation is significant; it can lead to session token theft, unauthorized administrative actions, redirection to malicious domains, or the exfiltration of sensitive transactional data displayed on the order print page.\nThe absence of a patch or vendor-provided fix implies that the application logic continues to trust user input implicitly. Without explicit remediation, the application remains susceptible to any payload that can be injected via the parameters expected by the order-print.jsp component, confirming that the lack of input/output sanitization is a systemic flaw in the handling of dynamic print requests."
}