Design/Logic Flaw

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

Cross site request forgery (csrf)

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

Design/Logic Flaw

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

CVE-2018-18433

DESTOON B2B 7.0 contains a cross-site scripting (XSS) vulnerability in admin/category.inc.php, exploitable via the category[catname] parameter to admin.php. Affected component is the admin interface; root cause is unescaped user input flowing into the response. Public sources (NVD/CNVD/CVE record...

CVE-2018-18432

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

CVE-2018-18430

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

CVE-2018-18433

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

CVE-2018-18431

DESTOON B2B 7.0 contains a cross-site scripting (XSS) vulnerability exposed via text boxes when visiting admin.php?moduleid=2&action=add. The CVE entry and CNVD/NVD variants describe the same issue, with no explicit details on affected build flavors beyond version 7.0 and the vulnerable input poi...

CVE-2018-18432

Summary: DESTOON B2B 7.0 is affected by a CSRF vulnerability that can be exploited via the admin.php URI with an action=add request. Multiple sources (NVD entry CVE-2018-18432 and CNVD/NVD references) confirm a CSRF flaw in DESTOON B2B 7.0. The CVSS metrics indicate a network-based, high-severity...

CVE-2018-18430

DESTOON B2B 7.0 contains an XSS vulnerability in admin/setting.inc.php reachable via the first text box to the admin.php URI. The issue is publicly documented across multiple sources (NVD entry CVE-2018-18430; CNVD/CVELIST entries) and is reflected with a CVSS profile indicating a MEDIUM base sev...

CVE-2018-18431

An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...

PT-2018-14457

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue exists where XSS is possible via certain text boxes to the "admin.php?moduleid=2&action=add" URI. Recommendations For DESTOON B2B version 7.0, consider restricting access to the admin.php module to...

CVE-2018-18433: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

CVE-2018-18431: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...

PT-2018-14459

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue was discovered in the software, where the categorycatname parameter in the "admin.php" URI is vulnerable to XSS. This occurs in the "admin/category.inc.php" file. Recommendations For DESTOON B2B...

CVE-2018-18432: Cross-Site Request Forgery (CSRF)

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

CVE-2018-18430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

PT-2018-14458

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue exists where CSRF is possible via the "admin.php" URI in an "action=add" request. Recommendations For DESTOON B2B version 7.0, consider implementing CSRF protection mechanisms, such as tokens, to...

PT-2018-14456

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue was discovered in the software, where the adminsetting.inc.php file has a cross-site scripting XSS vulnerability via the first text box to the admin.php URI. Recommendations For DESTOON B2B version...

File Upload Vulnerability in DESTOON B2B Website Management System

DESTOON B2B website management system is an open source B2B e-commerce industry portal solution based on PHP+MySQL. Currently, it has models of launchers, substations, malls, supply, requisition, quotation, companies, exhibitions, articles, information, PinPong, group purchasing, galleries,...