CVE-2020-20640

Published: Jun 28, 2021Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability.

Affected (1)

Products: Shopex: Ecshop

Shopex

1 product

Ecshop

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Shopex Ecshop	Version 4.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.jianshu.com/p/219755c047a1

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.jianshu.com/p/219755c047a1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.