Alfaz Hossain

Authenticated customers can inject malicious HTML payloads through the chat and support ticket messaging systems. This occurs due to unsanitized rendering via the `v-html` directive in the following files: `Messages.vue`, `RightChatSidebar.vue`, `SupportTicketMessages.vue`, and `SupportTicketDetails.vue`. An attacker can submit crafted message content that executes arbitrary JavaScript in the browser of a shop owner or administrator who views the message, potentially leading to session cookie theft and account takeover.

An unauthenticated SQL injection exists in the product listing API. The issue occurs because the `rating` parameter in the 'products' endpoint is concatenated directly into a MySQL HAVING clause without parameterization within `ProductController.php`. This allows attackers to perform time-based blind SQL injection—a technique used to infer data by observing the time the server takes to respond to specific queries—to extract the entire database, including user credentials and administrator password hashes. Additionally, because the database connection runs as root, there is a potential for unauthorized file system access.

An issue exists where the user interface misrepresents critical information, which could allow an unauthorized attacker to perform spoofing over a network.

A user interface (UI) misrepresentation of critical information allows an unauthorized attacker to perform spoofing over a network. By using a crafted URL, an attacker can manipulate the screen to deceive the user.