PT-2019-18967 · Unknown · Online Store

Larry W. Cashdollar · Publicado 2019-10-01 · Atualizado 2019-10-04 · CVE-2019-8290

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Online Store version 1.0

Description The issue allows the registration form requirements for the member email format to be bypassed by posting directly to the "sent register.php" endpoint, enabling special characters to be included and an XSS payload to be injected.

Recommendations For version 1.0, consider validating and sanitizing user input in the registration form to prevent the inclusion of special characters and XSS payloads. As a temporary workaround, restrict access to the "sent register.php" endpoint to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-8290

Produtos afetados

Online Store

Referências · 5

• 🔥 http://openwall.com/lists/oss-security/2019/10/02/1 · Exploit
• https://abcprintf.com/view_download.php?id=17 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-8290 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-8290 · Aviso do Fabricante
• http://vapidlabs.com/advisory.php?v=210 · Nota