PT-2020-15206 · Dbhcms · Dbhcms

Published 2020-08-24 · Updated 2020-08-25 · CVE-2020-19880

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0

Description The issue is related to a stored XSS vulnerability due to the lack of proper input sanitization, specifically the absence of the htmlspecialchars function for the 'Name' field in dbhcmstypes.php. This allows a remote unauthenticated attacker to exploit the vulnerability, potentially leading to the hijacking of other users' sessions.

Recommendations For DBHcms version 1.2.0, consider applying proper input validation and sanitization, such as using the htmlspecialchars function for the Name field in dbhcmstypes.php to prevent XSS attacks. As a temporary workaround, restrict access to the vulnerable types.php file until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-19880

Affected Products

Dbhcms

References · 3

• 🔥 https://github.com/fragrant10/cve/tree/master/dbhcms1.2.0#4 · Exploit
• https://osv.dev/vulnerability/CVE-2020-19880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19880 · Security Note