XSS Vulnerability in osCommerce Product by osCommerce
CVE-2020-29070

4.8MEDIUM

Key Information:

Vendor

Oscommerce

Status
Oscommerce
Vendor
CVE Published:
25 November 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-29070?

An XSS vulnerability exists in osCommerce 2.3.4.1, where an authenticated user can inject malicious scripts via the title field of newsletters. This security flaw allows attackers to execute arbitrary JavaScript code in the context of another user's session, potentially compromising sensitive information and gaining unauthorized access. It highlights the importance of proper input validation and sanitization in order to secure web applications against such exploits.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2020-29070
Created by aslanemre

References

https://github.com/gburton/CE-Phoenix/commits/master
x_refsource_MISC
https://forums.oscommerce.com/forum/17-news-and-announcem...
x_refsource_MISC
https://github.com/aslanemre/cve-2020-29070/blob/main/CVE...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.