PT-2019-19349 · Php Scripts Mall · Php Appointment Booking Script

Aniket Dinda · Published 2019-02-23 · Updated 2019-02-25 · CVE-2019-9066

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall PHP Appointment Booking Script version 3.0.3

Description The issue allows HTML injection in a user profile, which could potentially be used to inject malicious code.

Recommendations For PHP Scripts Mall PHP Appointment Booking Script version 3.0.3, consider validating and sanitizing user input to prevent HTML injection until a patch is available. As a temporary workaround, restrict the ability for users to input HTML code in their profiles to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-9066

Affected Products

Php Appointment Booking Script

References · 3

• 🔥 https://hackingvila.wordpress.com/2019/02/22/php-scripts-mall-php-appointment-booking-script-has-html-injection-via-an-edit-my-profile · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9066 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9066 · Vendor Advisory