Code injection

2020-09-1804:15:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.2%

JSON

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST[‘xml’]) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CPENameOperatorVersion
dotplant2eq< 2020914

CPE	Name	Operator	Version
	dotplant2	eq	< 2020914

References

github.com/DevGroup-ru/dotplant2/issues/400