PT-2022-22869 · Eshop · Eshop

Keyvan Hardani · Published 2022-08-08 · Updated 2022-08-12 · CVE-2022-35493

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions eShop - Multipurpose Ecommerce Store Website version 3.0.4

Description A Cross-site scripting (XSS) issue exists in the json search parse and the json response, allowing remote attackers to inject arbitrary web script or HTML via the "get products?search" parameter. This enables attackers to execute malicious scripts on the client-side.

Recommendations For eShop - Multipurpose Ecommerce Store Website version 3.0.4, consider restricting access to the get products?search parameter until a patch is available. As a temporary workaround, avoid using the search parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-35493

Affected Products

Eshop

References · 4

• 🔥 https://github.com/Keyvanhardani/Exploit-eShop-Multipurpose-Ecommerce-Store-Website-3.0.4-Cross-Site-Scripting-XSS/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-35493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35493 · Security Note
• https://t.me/cibsecurity/47746 · Telegram Post