PT-2019-19349 · Php Scripts Mall · Php Appointment Booking Script

Aniket Dinda · Publicado 2019-02-23 · Atualizado 2019-02-25 · CVE-2019-9066

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall PHP Appointment Booking Script version 3.0.3

Description The issue allows HTML injection in a user profile, which could potentially be used to inject malicious code.

Recommendations For PHP Scripts Mall PHP Appointment Booking Script version 3.0.3, consider validating and sanitizing user input to prevent HTML injection until a patch is available. As a temporary workaround, restrict the ability for users to input HTML code in their profiles to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-9066

Produtos afetados

Php Appointment Booking Script

Referências · 3

• 🔥 https://hackingvila.wordpress.com/2019/02/22/php-scripts-mall-php-appointment-booking-script-has-html-injection-via-an-edit-my-profile · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9066 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9066 · Aviso do Fabricante