Multiple XSS Vulnerabilities in osCommerce CE Phoenix by osCommerce
CVE-2020-12058
What is CVE-2020-12058?
Several Cross-Site Scripting (XSS) vulnerabilities exist in osCommerce CE Phoenix prior to version 1.0.6.0, allowing attackers to inject and execute arbitrary JavaScript code. This exploitation can occur through various parameters in the admin module URLs, such as 'page', 'zpage', and 'spage', potentially compromising the integrity of the affected systems. Attackers can target catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php, enabling them to manipulate web pages viewed by users. Addressing these vulnerabilities is critical for maintaining the security and integrity of e-commerce applications.