CVE-2018-1000640

Published: Aug 20, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be exploitable via Malicious input passed in GET parameter.

Affected (1)

Products: Villagedefrance: Opencart Overclocked

Villagedefrance

1 product

Opencart Overclocked

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Villagedefrance Opencart Overclocked	Up to 1.11.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://0dd.zone/2018/08/05/OpenCart-Overclocked-Reflected-XSS/

Source: cve@mitre.org

Third Party Advisory

https://github.com/villagedefrance/OpenCart-Overclocked/issues/190

Source: cve@mitre.org

Vendor Advisory

https://0dd.zone/2018/08/05/OpenCart-Overclocked-Reflected-XSS/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/villagedefrance/OpenCart-Overclocked/issues/190

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.