Cosmoshop - XSS on Admin-Login Mask

Type securityvulns
Reporter Securityvulns
Modified 2015-02-22T00:00:00


author: l0om page: date: 14.02.2015

Cosmoshop is a simple webshop designed for the german market.

There is a simple XSS flaw at the admin-login panel in probably all cosmoshop versions. The admin login can be found at

This page will show a typical login screen. The username field is filled with the value of "u_name". Since this parameter isn't filtered you can inject javascript code and trick someone to execute it.><script>alert("hello")</script>

nothing special but better to know.

Greetings and so long, l0om