Cross Site Scripting Vulnerability in ECShop by ECShop Developer
CVE-2020-20640

6.1MEDIUM

Key Information:

Vendor

Shopex

Status
Ecshop
Vendor
CVE Published:
28 June 2021

What is CVE-2020-20640?

A Cross Site Scripting vulnerability exists in ECShop 4.0 due to inadequate security filtering within user.php. Attackers can exploit this flaw using HTML entity encoding to circumvent protections implemented in safety.php, enabling them to inject malicious scripts. This represents a significant security risk for online retailers, compromising user data and website integrity.

References

https://www.jianshu.com/p/219755c047a1
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.