PT-2024-10807 · Unknown · Simplcommerce

Nj0R0 · Published 2024-04-30 · Updated 2024-08-01 · CVE-2020-27478

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Simplcommerce versions 40734964b0811f3cbaf64b6dac261683d256f961 through 3103357200c70b4767986544e01b19dbf11505a7

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted script to the search bar feature.

Recommendations For versions 40734964b0811f3cbaf64b6dac261683d256f961 through 3103357200c70b4767986544e01b19dbf11505a7, consider disabling the search bar feature until a patch is available to prevent exploitation. Restrict access to the search bar to minimize the risk of arbitrary code execution. Avoid using the search bar feature in the affected versions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-27478

Affected Products

Simplcommerce

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-27478 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27478 · Vendor Advisory
• https://github.com/simplcommerce/SimplCommerce/issues/943 · Note
• https://twitter.com/CVEnew/status/1785378434941677955 · Twitter Post