PT-2018-9640 · Iscripts · Iscripts Eswap

Manhnho · Publicado 2018-04-11 · Atualizado 2018-05-09 · CVE-2018-10049

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: iScripts eSwap version 2.4

Description: The issue is related to a security problem where an attacker can inject malicious code. This is possible due to insufficient input validation in the txtDate parameter, which is part of the "registration settings.php" file in the Admin Panel.

Recommendations: For iScripts eSwap version 2.4, ensure proper validation and sanitization of user input for the txtDate parameter in the "registration settings.php" file to prevent malicious code injection. As a temporary workaround, consider restricting access to the Admin Panel until a proper fix is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-10049

Produtos afetados

Iscripts Eswap

Referências · 3

• 🔥 https://pastebin.com/QbhRJp4q · Exploit
• https://osv.dev/vulnerability/CVE-2018-10049 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10049 · Nota de Segurança