PT-2018-18184 · Php Scripts Mall · Php Scripts Mall Hot Scripts Clone

Neeraj Kumar · Published 2018-03-06 · Updated 2018-03-27 · CVE-2018-7650

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1

Description The application is vulnerable to stored XSS within the "Add New" function for a Management User. The issue arises because the application does not sanitize user-supplied input to the name parameter, allowing injected JavaScript code to be rendered to the user's browser.

Recommendations For PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1, ensure proper sanitization of user input to the name parameter within the "Add New" function to prevent XSS attacks. As a temporary workaround, consider restricting access to the "Add New" function for Management Users until a proper fix is implemented.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-7650

Affected Products

Php Scripts Mall Hot Scripts Clone

References · 3

• 🔥 https://neetech18.blogspot.in/2018/03/stored-xss-vulnerability-in-hot-scripts.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7650 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7650 · Vendor Advisory