Summary
This host is installed with Prestashop
and is prone to cross site scripting vulnerability.
Impact
Successful exploitation will allow remote
attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
Impact Level: Application
Solution
No solution or patch is available as of
18th February, 2015. Information regarding this issue will be updated once the solution details are available. For updates refer https://www.prestashop.com
Insight
This flaw exists because
/modules/blocklayered/blocklayered-ajax.php script does not validate input to the 'layered_price_slider' parameter before returning it to users.
Affected
Prestashop version 1.6.0.9 and earlier.
Detection
Send a crafted request via HTTP GET
request and check whether it is able to read cookie or not.
References
Severity
Classification
-
CVE CVE-2015-1175 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities