K08Uk0Vu

A stored cross-site scripting issue exists where authenticated back-office administrators with store update permissions can inject scripts. This occurs by uploading unsanitized SVG images via the `logo file` or `banner file` variables. The malicious scripts, using an onload payload, are served from the '/admin/store-media/logo' endpoint or the 'public cache/images/store/' directory, allowing execution against visitors and higher-privileged administrators.

A cross-site request forgery issue exists where the '/admin/product/combinations/update' and '/admin/product/default-price/update' endpoints accept GET requests without verifying anti-CSRF tokens. This allows an attacker to trick an authenticated administrator into clicking a malicious link to modify product combination details, including prices, stock, weight, EAN, and sale flags, potentially resetting omitted prices to zero.

A stored cross-site scripting issue exists in the `getSummary()` function of the `ForSomeCustomers` class. Unauthenticated attackers can inject malicious scripts through unescaped customer names. By registering with a script payload as their name, the script executes when administrators view related coupons, potentially allowing the theft of CSRF (Cross-Site Request Forgery) tokens—a technique used to impersonate a user—to create unauthorized administrator accounts.

A cross-site request forgery issue exists in the back office where per-session CSRF tokens leak through URL query strings. This allows attackers to forge administrative actions by reusing leaked tokens or targeting the unprotected `setToggleVisibilityAction()` and `updatePositionAction()` functions. Consequently, authenticated administrators may be tricked into deleting, hiding, or reordering configuration and catalogue objects.

A cross-site request forgery (CSRF) issue exists where remote attackers can delete page tags, documents, and images. This occurs because back-office delete routes lack CSRF tokens—unique identifiers used to prevent unauthorized requests—and permission checks. Attackers can trick a logged-in administrator into clicking crafted GET requests that iterate through sequential IDs to remove TheliaLibrary images, including their associated files and variants, across pages, products, and categories.