PT-2021-17309 · Unknown · Peel Shopping

Anmol K Sachan · Published 2021-02-12 · Updated 2021-12-07 · CVE-2021-27190

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PEEL SHOPPING versions 9.3.0 through 9.4.0

Description: A Stored Cross Site Scripting(XSS) issue was discovered, allowing an attacker to input malicious JavaScript. This can lead to stealing cookies or redirecting users to malicious websites. The vulnerability occurs when user-supplied input containing a polyglot payload is echoed back in JavaScript code within an HTML response.

Recommendations: For versions 9.3.0 and 9.4.0, consider disabling the change params.php functionality as a temporary workaround until a patch is available. Restrict access to the utilisateurs/change params.php endpoint to minimize the risk of exploitation. Avoid using user-supplied input in JavaScript code within HTML responses until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-27190

Affected Products

Peel Shopping

References · 9

• 🔥 https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS · Exploit
• 🔥 https://secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address · Exploit
• 🔥 https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS · Exploit
• https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-27190 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27190 · Vendor Advisory
• https://peel-shopping.com/modules/telechargement/telecharger.php?id=7 · Vendor Advisory
• https://t.me/cvenotify/10105 · Telegram Post
• https://t.me/cibsecurity/23514 · Telegram Post