CVE-2025-65591
📋 TL;DR
nopCommerce 4.90.0 contains a cross-site scripting vulnerability in its Currencies functionality that allows attackers to inject malicious scripts into web pages. This affects administrators and users who view currency-related pages. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- nopCommerce
📦 What is this software?
Nopcommerce by Nopcommerce
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full e-commerce platform takeover, data theft, and malicious code injection affecting all customers.
Likely Case
Session hijacking of administrators or users, credential theft, and defacement of currency-related pages.
If Mitigated
Limited impact with proper input validation and output encoding in place, potentially only affecting specific administrative functions.
🎯 Exploit Status
Exploitation requires user interaction (viewing malicious content) but XSS payloads are simple to craft. The vulnerability is in the admin interface's Currencies section.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.90.1 or later
Vendor Advisory: https://www.nopcommerce.com/
Restart Required: Yes
Instructions:
1. Backup your nopCommerce database and files. 2. Download nopCommerce 4.90.1 or later from the official website. 3. Replace the existing installation files with the patched version. 4. Restart the web application. 5. Verify the patch by testing currency functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for all currency-related fields to reject malicious scripts.
Modify CurrenciesController.cs to add input validation using ASP.NET Core's built-in validation attributes
Output Encoding
allApply proper HTML encoding to all currency data displayed in views.
Update Razor views to use @Html.Raw() only for trusted content and @Html.Encode() for user-controlled data
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules to block malicious payloads.
- Restrict access to the Currencies functionality to trusted administrators only and monitor for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check if your nopCommerce version is 4.90.0 by viewing the admin dashboard or checking the web.config file version.Check Version:
Check the version in Admin → System → System Information or examine the web.config file for version metadata.Verify Fix Applied:
After patching, test the Currencies functionality by attempting to inject basic XSS payloads (e.g., <script>alert('test')</script>) and verify they are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /Admin/Currency/Edit or /Admin/Currency/Create with script tags
- Multiple failed login attempts following currency page views
Network Indicators:
- HTTP requests containing script tags in currency-related parameters
- Unexpected redirects from currency pages
SIEM Query:
source="web_server" AND (uri_path="/Admin/Currency/*" AND (request_body CONTAINS "<script>" OR request_body CONTAINS "javascript:"))