PT-2021-10518 · Ecshop · Ecshop

Cyc1E · Published 2021-06-28 · Updated 2021-07-01 · CVE-2020-20640

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ECShop version 4.0

Description: The issue is related to a Cross Site Scripting (XSS) vulnerability due to security filtering issues. Specifically, in the user.php file, it is possible to use HTML entity encoding to bypass the security policy defined in the safety.php file, which triggers the XSS vulnerability.

Recommendations: For ECShop version 4.0, update the security filtering mechanism in the user.php file to properly handle HTML entity encoding and prevent bypassing of the security policy defined in the safety.php file. As a temporary workaround, consider restricting access to the user.php file until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-20640

Affected Products

Ecshop

References · 3

• 🔥 https://jianshu.com/p/219755c047a1 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20640 · Security Note