CVE-2023-7108 - code-projects E-Commerce Website user_signup.php cross site scripting

Back Back to CVE browser

MEDIUM

code-projects E-Commerce Website user_signup.php cross site scripting

Published Dec 26, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.83%

Description

A vulnerability classified as problematic has been found in code-projects E-Commerce Website 1.0. This affects an unknown part of the file user_signup.php. The manipulation of the argument firstname with the input <video/src=x onerror=alert(document.domain)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249003.

Affected products

Vendor Code-Projects Product E-Commerce Website Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Code-Projects

E-Commerce Website

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/h4md153v63n/CVEs/blob/main/E-Commerce_Website/E-Commerce%20Website%20-%20Stored%20Cross-site%20Scripting.md
exploit
https://vuldb.com/?ctiid.249003
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.249003
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/h4md153v63n/CVEs/blob/main/E-Commerce_Website/E-Commerce%20Website%20-%20Stored%20Cross-site%20Scripting.md		exploit
https://vuldb.com/?ctiid.249003		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.249003		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry