EC-CUBE XSS Flaw Actively Exploited

Possible XSS Payload Submitted to EC-CUBE Admin Interface

Detects common JavaScript XSS payload markers (script tags, event handlers, javascript: URIs) submitted in request parameters to admin management endpoints, consistent with in-the-wild exploitation of the EC-CUBE admin XSS flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Possible XSS Payload Submitted to EC-CUBE Admin Interface
id: 9bda00ad-9813-5896-8f92-789f1cb5f137
status: experimental
description: 'Detects HTTP requests containing common cross-site scripting (XSS) payload

  markers (script tags, inline event handlers, javascript: URIs) sent to

  admin-facing PHP application paths. This pattern matches active exploitation

  reported against the EC-CUBE admin management screen XSS vulnerability,

  where malicious script is injected into input fields and later executed

  when an administrator views the affected page.

  '
references:
- https://www.ipa.go.jp/
logsource:
  category: webserver
  product: generic
detection:
  selection_admin_path:
    cs-uri-stem|contains:
    - /admin/
    - admin.php
  selection_xss_markers:
    cs-uri-query|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - '%3Cscript'
  filter_common_scanners:
    cs-uri-query|contains:
    - test=<script>alert
  condition: selection_admin_path and selection_xss_markers and not filter_common_scanners
falsepositives:
- Authorized vulnerability scanning or penetration testing of the admin panel
- Security researchers manually testing input validation on staging environments
level: medium
tags:
- attack.t1059.007
- attack.initial_access
author: Vorant