PT-2011-4979 · Prestashop · Prestashop

Published

2011-12-01

·

Updated

2011-12-13

·

CVE-2011-4544

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Prestashop versions prior to 1.5
Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various parameters to different API endpoints, including:
  • address or relativ base dir parameter to "modules/mondialrelay/googlemap.php"
  • relativ base dir, Pays, Ville, CP, Poids, Action, or num parameter to "prestashop/modules/mondialrelay/googlemap.php"
  • num mode parameter to "modules/mondialrelay/kit mondialrelay/RechercheDetailPointRelais ajax.php"
  • Expedition parameter to "modules/mondialrelay/kit mondialrelay/SuiviExpedition ajax.php"
  • folder or name parameter to "admin/ajaxfilemanager/ajax save text.php" No information is provided about the estimated number of potentially affected devices or real-world incidents.
Recommendations For Prestashop versions prior to 1.5, update to version 1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable parameters, such as address, relativ base dir, Pays, Ville, CP, Poids, Action, num, num mode, Expedition, folder, and name, in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-4544

Affected Products

Prestashop