PT-2018-10618 · Php Scripts Mall · Php Scripts Mall Website Seller Script

Ck01 · Published 2018-05-26 · Updated 2020-08-24 · CVE-2018-11501

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Website Seller Script version 2.0.3

Description The issue allows for CSRF via the user submit.php endpoint with the upd parameter set to 2, resulting in XSS.

Recommendations For version 2.0.3, as a temporary workaround, consider restricting access to the user submit.php endpoint with the upd parameter set to 2 to minimize the risk of exploitation.

Exploit

Fix

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

CVE-2018-11501

Affected Products

Php Scripts Mall Website Seller Script

References · 4

• 🔥 https://whitehatck01.blogspot.com/2018/02/website-seller-script-203-stored-xss.html · Exploit
• 🔥 https://gkaim.com/cve-2018-11501-vikas-chaudhary · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11501 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11501 · Vendor Advisory