PT-2020-10389 · Php Scripts Mall · Advanced-Real-Estate-Script

Published 2020-01-05 · Updated 2020-01-09 · CVE-2019-20336

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall advanced-real-estate-script version 4.0.9

Description The issue concerns a problem where the searchtext parameter in the "search-results.php" endpoint is vulnerable to XSS. This means an attacker could potentially inject malicious scripts into the website, affecting users who visit the page.

Recommendations For version 4.0.9, consider validating and sanitizing the searchtext parameter in the "search-results.php" endpoint to prevent XSS attacks. As a temporary workaround, restrict access to the search functionality until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20336

Affected Products

Advanced-Real-Estate-Script

References · 3

• 🔥 https://github.com/Mad-robot/CVE-List/blob/master/Advanced%20Real%20Estate%20Script.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20336 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20336 · Vendor Advisory