Cross Site Scripting (XSS) Vulnerability Discovered in Online Shop Store 1.0
CVE-2024-8566
Key Information:
- Vendor
Code-projects
- Status
- Vendor
- CVE Published:
- 8 September 2024
Badges
What is CVE-2024-8566?
The vulnerability in Code-Projects' Online Shop Store version 1.0 exists within the settings.php file. It allows for cross site scripting (XSS) attacks due to improper validation of the error argument. Attackers can exploit this weakness remotely, potentially compromising user sessions and manipulating data as a result. The vulnerability has been publicly disclosed, increasing the urgency for affected users to apply patches or implement mitigations to prevent exploitation.
Affected Version(s)
Online Shop Store 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
Vulnerability published
- 🟡
Public PoC available
- 👾
Exploit known to exist