PT-2019-18967 · Unknown · Online Store

Larry W. Cashdollar · Published 2019-10-01 · Updated 2019-10-04 · CVE-2019-8290

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Online Store version 1.0

Description The issue allows the registration form requirements for the member email format to be bypassed by posting directly to the "sent register.php" endpoint, enabling special characters to be included and an XSS payload to be injected.

Recommendations For version 1.0, consider validating and sanitizing user input in the registration form to prevent the inclusion of special characters and XSS payloads. As a temporary workaround, restrict access to the "sent register.php" endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-8290

Affected Products

Online Store

References · 5

• 🔥 http://openwall.com/lists/oss-security/2019/10/02/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-8290 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8290 · Vendor Advisory
• https://abcprintf.com/view_download.php?id=17 · Note
• http://vapidlabs.com/advisory.php?v=210 · Note