Duplicate Advisory: PrestaShop Cross-site Scripting vulnerability

2023-05-1200:30:18

CWE-79

GitHub Advisory Database

github.com

duplicate advisory

withdrawn

ghsa-95hx-62rh-gg96

cross-site scripting

prestashop v1.7.7.4

arbitrary web scripts

html

crafted payload

JSON

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-95hx-62rh-gg96. This link is maintained to preserve external references.

Original Description

A cross-site scripting (XSS) vulnerability in PrestaShop v1.7.7.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the message parameter in /contactform/contactform.php.

Affected configurations

Vulners

Node

prestashopprestashopRange≤1.7.7.4

VendorProductVersionCPE
prestashopprestashop*cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
prestashop	prestashop	*	cpe:2.3:a:prestashop:prestashop::::::::

References

github.com/advisories/GHSA-6mhc-hqr3-w466

github.com/mustgundogdu/Research/blob/main/PrestaShop/ReflectedXSS_1.7.7.4.md

nvd.nist.gov/vuln/detail/CVE-2023-31508

JSON

Related for GHSA-6MHC-HQR3-W466