PT-2022-19963 · Unknown · Sourcecodester Online Market Place Site

Published 2022-09-26 · Updated 2022-09-28 · CVE-2022-30003

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Market Place Site version 1.0

Description The issue allows attackers to register as a Seller and then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields. This enables Cross Site Scripting (XSS) attacks.

Recommendations For Sourcecodester Online Market Place Site version 1.0, consider validating and sanitizing user input in the 'Product Title' and 'Short Description' fields to prevent XSS payloads. As a temporary workaround, restrict the ability for Sellers to create new products until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30003

Affected Products

Sourcecodester Online Market Place Site

References · 6

• 🔥 https://packetstormsecurity.com/files/168250/omps10-xss.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-30003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30003 · Security Note
• https://t.me/cibsecurity/50524 · Telegram Post
• https://sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html · Note
• https://t.me/cvenotify/36929 · Telegram Post