PT-2021-11694 · Unknown+2 · Simplcommerce+3

0Xnibbles · Published 2021-01-14 · Updated 2021-01-21 · CVE-2020-29587

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SimplCommerce version 1.0.0-rc

Description: The issue arises from the use of the Bootbox.js library in SimplCommerce, which allows for the creation of programmatic dialog boxes using Bootstrap modals. This library does not sanitize user input, resulting in a DOM XSS vulnerability. The vulnerability occurs because the library uses the jQuery .html() function to directly append the payload to a dialog, allowing for the execution of malicious code.

Recommendations: For SimplCommerce version 1.0.0-rc, consider disabling the use of the Bootbox.js library until a patch is available, or restrict the input allowed to be appended to the dialog box to prevent malicious code execution. As a temporary workaround, avoid using the .html() function to append user input to the dialog box.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-29587

Affected Products

Bootbox.Js

Bootstrap

Simplcommerce

Jquery

References · 6

• 🔥 https://github.com/simplcommerce/SimplCommerce/issues/969 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-29587 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29587 · Vendor Advisory
• https://t.me/cvenotify/8538 · Telegram Post
• https://t.me/cvenotify/8825 · Telegram Post
• https://t.me/cibsecurity/22158 · Telegram Post