PrestaShop 1.4.4.1 – ‘/modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php?Expedition’ Cross-Site Scripting

Exploit Database
120 阅读

作者： Prestashop

日期： 2011-11-23
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/36343/

source: https://www.securityfocus.com/bid/50784/info

PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected.

GET: http://<app_base>/modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php

POST: Expedition=<script>alert('XSS')</script>

last Exploits
PrestaShop 1.4.4.1 – ‘/modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php?Expedition’ Cross-Site Scripting的更多信息

CASAP Automated Enrollment System 1.0 – ‘First Name’ Stored XSS：
Patient folder (THEME ASP) – SQL Injection：
Spring Cloud 3.2.2 – Remote Command Execution (RCE)：
Typo3 Extension JobControl 2.14.0 – Cross-Site Scripting / SQL Injection：
PHPFox – Access Control Security Bypass：
userSpice 4.3.24 – ‘X-Forwarded-For’ Cross-Site Scripting：
PaysiteReviewCMS – ‘image.php’ Cross-Site Scripting：
BlogEngine.NET 3.3.6/3.3.7 – XML External Entity Injection：