vendor:
PaulShop CMS with Shopping Cart System
by:
BTIS Team
8,8
CVSS
HIGH
SQL Injection and Stored XSS
89 (SQL Injection) and 79 (XSS)
CWE
Product Name: PaulShop CMS with Shopping Cart System
Affected Version From: 03/27/2017
Affected Version To: 03/27/2017
Patch Exists: NO
Related CWE: N/A
CPE: a:codecanyon:paulshop_cms_with_shopping_cart_system
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Apache/2.4.7 (Ubuntu)
2017
PaulShop CMS – Sql Injection and stored XSS
PaulShop CMS is vulnerable to SQL Injection and Stored XSS. An attacker can inject malicious SQL queries into the 'q' parameter of the search page and inject malicious JavaScript code into the parameters of the member's profile page.
Mitigation:
Input validation should be used to prevent SQL Injection and XSS attacks. Sanitize user input and escape output to prevent malicious code from being executed.
