Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.

Affected: Packagist: craftcms/commerce

## Summary

A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the **Store Management** section is not properly sanitized before being displayed in the admin panel.

--- ## Proof of Concept

### Requirments - General permissions: - Access the control panel - Access Craft Commerce - Craft Commerce permissions: - Manage store settings - Manage shipping - An active administrator elevated session

### Steps to Reproduce

1. Log in to the Admin Panel with the attacker account with the permissions mentioned above. 2. Navigate to **Commerce** -> **Store Management** -> **Shipping Methods** (`/admin/commerce/store-management/primary/shippingmethods`). 3. Create a new shipping method. 4. In the **Name** field, enter the following payload: ```html <img src=x onerror="alert(document.domain)"> ``` 4. Click **Save** & Go back to the previous page. 5. Notice the alert proving JavaScript execution.

### Privilege Escalation to Administrator:

1. Do the same steps above, but replace the payload with a malicious one. 2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `<UserID>` with your attacker id: 3. ```html <img src=x onerror="fetch('/admin/users/<UserID>/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}&userId=<UserID>&admin=1&action=users/save-permissions`,header…