Cross Site Scripting vulnerability in Ecommerce-CodeIgniter-Bootstrap by Kiril Kirkov

CVE-2023-23010

What is CVE-2023-23010?

The Ecommerce-CodeIgniter-Bootstrap is susceptible to a Cross Site Scripting (XSS) vulnerability due to improper input validation within the 'add_product.php' file. Attackers can exploit this weakness by manipulating the 'languages' and 'trans_load' parameters, enabling them to execute arbitrary scripts in the context of the affected website. This security flaw can lead to various malicious activities, including the theft of session cookies and the execution of unauthorized actions on behalf of the victim. It is crucial for users of this product to apply recommended security patches and follow best practices to mitigate potential risks.

References