PT-2018-17812 · Php Scripts Mall · Php Scripts Mall Car Rental Script

Published 2018-04-12 · Updated 2018-05-16 · CVE-2018-6904

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Car Rental Script version 2.0.8

Description The issue is related to a Cross-Site Scripting (XSS) problem. It occurs via the User Name field in an Edit Profile action. This allows for potential malicious script injection.

Recommendations For PHP Scripts Mall Car Rental Script version 2.0.8, consider validating and sanitizing user input in the User Name field to prevent XSS attacks. As a temporary workaround, restrict the ability to edit profiles until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-6904

Affected Products

Php Scripts Mall Car Rental Script

References · 3

• 🔥 https://0day4u.wordpress.com/2018/03/12/car-rental-script-stored-xss · Exploit
• https://osv.dev/vulnerability/CVE-2018-6904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6904 · Security Note