-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-074 
Product:                   JTL-Shop 5
Manufacturer:              JTL-Software-GmbH
Affected Version(s):       < 5.6.3, 5.7.3, 5.8.0
Tested Version(s):         5.7.2
Vulnerability Type:        Cross-Site Scripting (CWE-79) 
Risk Level:                Medium
Solution Status:           Fixed
Manufacturer Notification: 2026-08-04
Solution Date:             2026-08-26
Public Disclosure:         2026-09-22
CVE Reference:             Not yet assigned
Author of Advisory:        Marcel Wölke, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

JTL-Shop is an e-commmerce system designed to be used with the JTL-Wawi 
ERP system.

The manufacturer describes the product as follows (see [1]):

"JTL-Shop is the shop software for anyone who wants to get started quickly
but doesn't want to compromise: intuitive operation, design freedom,
sales power and full ERP integration [...]."

Two URL parameters in the back end were discovered to be reflected into
the document without sufficient output escaping, making the application
vulnerable to reflected cross-site scripting (XSS). Depending on the
application's configuration, this can allow an attacker to steal an
administrator's session cookie after the administrator clicks a specifically
crafted link (e.g. delivered via phishing).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Attackers can send a malicious link containing JavaScript code to an
already authenticated administrator. Upon opening this link, the JavaScript
code is executed in the administrator's browser session.

Two attack vectors were found which allow for reflected XSS.

First, the '/admin/reviews' page was discovered to be vulnerable in the
'tab' URL parameter. This requires only an existing review entry and its ID.
Valid review IDs are publicly visible on product pages (e.g. in
'id="comment<id>"' element attributes), so an attacker can trivially
obtain one.

The second attack vector concerns the '/admin/activate' page, where the
payload can be inserted in the 'cSuchTyp' URL parameter (with any
non-empty 'cSuche' value). For this attack vector to work, at least one
entry must exist in the "Search queries" list. In practice, most shops
will have this list populated. Alternatively, attackers can populate
the list themselves by using the shop's search functionality.

The cookie attributes used by the application depend on the application's
configuration and the PHP configuration. In setups where the HttpOnly
attribute is not set, the session cookie can be read and exfiltrated
directly via JavaScript, allowing full takeover of the session.
If the compromised administrator is sufficiently privileged, a session takeover
can result in arbitrary code execution on the server, since highly privileged
administrators can upload extensions containing arbitrary code by design.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

XSS using '/admin/reviews' (requires existing review ID):
https://<DOMAIN>/admin/reviews?a=editieren&kBewertung=<existing review ID>&tab="><script>alert(document.cookie)</script>

XSS using '/admin/activate' (requires existing search query entry):
https://<DOMAIN>/admin/activate?Suche=1&cSuche=x&cSuchTyp="><script>alert(document.cookie)</script>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Administrators should apply the released patches.

In addition, website administrators should evaluate whether they can set
the HttpOnly attribute using the application's built-in settings to protect
against similar attack patterns. It should be noted that this can break some 
configurations, e.g. when using third-party extensions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-08-03: Vulnerability discovered
2026-08-04: Vulnerability reported to manufacturer
2026-08-06: Vulnerability acknowledged by manufacturer
2026-08-26: Fixes 5.6.3, 5.7.3, 5.8.0 and a security notice (see [2])
            released by manufacturer
2026-09-22: Public disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for JTL-Shop
    https://www.jtl-software.com/en/ecommerce-platform
[2] Security notice by manufacturer 
    https://www.jtl-software.com/de/shop-patch-xss
[3] SySS Security Advisory SYSS-2026-074
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-074.txt
[4] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Marcel Wölke of SySS GmbH with
the assistance of AI.

E-Mail: marcel.woelke@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Marcel_Woelke.asc
Key ID: 0xE3CB1C0CCD366083
Key Fingerprint: 27C6 3368 E540 DBD3 B052 EBB8 E3CB 1C0C CD36 6083

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQnxjNo5UDb07BS67jjyxwMzTZggwUCarJQ4QAKCRDjyxwMzTZg
g0drAP4nkFs8SxVS7TUybWJuUH4l0kv8KqwfwqCCaDcRGLsqDgEA0QpBV6EoW77H
huUztY1S6D83NQD9tHKymfSA9LiwkA0=
=9WyD
-----END PGP SIGNATURE-----