Peel SHOPPING - version 2.8 and version 2.9 xss/sql inject Vulnerability

vendor:

SHOPPING

by:

Cyber-Crystal

8,8

CVSS

HIGH

XSS/SQL Injection

79 (XSS) and 89 (SQL Injection)

CWE

Product Name: SHOPPING

Affected Version From: 2.8

Affected Version To: 2.9

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

n/a

Peel SHOPPING – version 2.8 and version 2.9 xss/sql inject Vulnerability

The vulnerability exists in Peel SHOPPING version 2.8 and version 2.9. It allows attackers to inject malicious XSS and SQL payloads via the 'motclef' parameter in the 'recherche.php' script, the 'id' parameter in the 'tva.php' script, and the 'index.php' script.

Mitigation:

Input validation should be used to prevent XSS and SQL injection attacks. All user-supplied input should be validated and filtered before being used in any SQL query.

Source

Exploit-DB raw data:

+-------------------------------------------------------------------------+
# Exploit Title : Peel SHOPPING - version 2.8 and version 2.9 xss/sql inject Vulnerability
# version       : v2.9                                                                                                                          
# Author        : Cyber-Crystal                                             
# Date          : n/a  
# Software Link : http://www.peel.fr/ || or http://www.easy-script.com/scripts-PHP/peel-v29-4308.html                                                                                
+-------------------------------------------------------------------------+


[+] Exploits

http://localhost/peel/index.php/achat/recherche.php?motclef=[Xss Here ]&action=Rechercher

http://localhost/peel/administrer/tva.php?mode=modif&id=[SQL]

http://localhost/peel/index.php/[XSS]





# The End //