PT-2020-15209 · Dbhcms · Dbhcms

Published 2020-08-24 · Updated 2020-08-25 · CVE-2020-19883

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0

Description The issue is related to a stored XSS vulnerability due to the lack of a security filter in the mod.users.view.php file, specifically on line 57, for the user login variable. A remote authenticated attacker with admin user privileges can exploit this to hijack other users' sessions.

Recommendations For DBHcms version 1.2.0, consider temporarily disabling the mod.users.view.php module until a patch is available, or restrict access to this module to minimize the risk of exploitation. Avoid using the user login variable in the affected code until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-19883

Affected Products

Dbhcms

References · 3

• 🔥 https://github.com/fragrant10/cve/tree/master/dbhcms1.2.0#5 · Exploit
• https://osv.dev/vulnerability/CVE-2020-19883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19883 · Security Note