PT-2021-20205 · Shopizer · Shopizer

Marek Toth · Published 2021-05-24 · Updated 2021-06-08 · CVE-2021-33562

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shopizer versions prior to 2.17.0

Description A reflected cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, for example, a "product/insert-product-name-here.html/ref=" URL. This enables attackers to execute malicious scripts on the client-side.

Recommendations For versions prior to 2.17.0, update to version 2.17.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ref parameter in the affected URL to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33562

GHSA-378P-HRQ3-X4P3

Affected Products

Shopizer

References · 8

• 🔥 https://exploit-db.com/exploits/49901 · Exploit
• https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271 · Patch
• https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0 · Patch
• https://osv.dev/vulnerability/CVE-2021-33562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33562 · Security Note
• https://osv.dev/vulnerability/GHSA-378p-hrq3-x4p3 · Vendor Advisory
• https://t.me/cvenotify/15157 · Telegram Post
• https://t.me/cvenotify/14970 · Telegram Post