PT-2018-9640 · Iscripts · Iscripts Eswap

Manhnho · Published 2018-04-11 · Updated 2018-05-09 · CVE-2018-10049

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: iScripts eSwap version 2.4

Description: The issue is related to a security problem where an attacker can inject malicious code. This is possible due to insufficient input validation in the txtDate parameter, which is part of the "registration settings.php" file in the Admin Panel.

Recommendations: For iScripts eSwap version 2.4, ensure proper validation and sanitization of user input for the txtDate parameter in the "registration settings.php" file to prevent malicious code injection. As a temporary workaround, consider restricting access to the Admin Panel until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-10049

Affected Products

Iscripts Eswap

References · 3

• 🔥 https://pastebin.com/QbhRJp4q · Exploit
• https://osv.dev/vulnerability/CVE-2018-10049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10049 · Security Note