PT-2015-5146 · Prestashop · Prestashop

Published 2015-01-22 · Updated 2018-10-09 · CVE-2015-1175

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.6.0.9 and earlier

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the layered price slider parameter in the blocklayered-ajax.php file of the blocklayered module.

Recommendations For PrestaShop versions 1.6.0.9 and earlier, avoid using the layered price slider parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-1175

Affected Products

Prestashop

References · 6

• 🔥 http://octogence.com/advisories/cve-2015-1175-xss-prestashop · Exploit
• 🔥 http://packetstormsecurity.com/files/130026/Prestashop-1.6.0.9-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-1175 · Security Note
• http://securityfocus.com/archive/1/534511/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1175 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100013 · Note