PT-2020-15501 · Ljcmsshop · Ljcmsshop

Published 2020-11-18 · Updated 2020-12-09 · CVE-2020-22723

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ljcmsshop version 1.14

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center and adding the payload to the delivery address.

Recommendations For version 1.14, consider disabling the account registration feature in the user center until a patch is available to prevent exploitation of the XSS issue via the user.php file. Restrict access to the user.php file to minimize the risk of arbitrary web script or HTML injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-22723

Affected Products

Ljcmsshop

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-22723 · Security Note
• https://osv.dev/vulnerability/CVE-2020-22723 · Vendor Advisory
• https://t.me/cibsecurity/17396 · Telegram Post
• https://t.me/cvenotify/5807 · Telegram Post
• https://t.me/cvenotify/6252 · Telegram Post
• https://freebuf.com/articles/web/192318.html · Note
• https://t.me/cibsecurity/16562 · Telegram Post
• https://baijiahao.baidu.com/s?id=1653681087434824406&wfr=spider&for=pc · Note