medium5.4Public exploit code
CVE-2018-7465
An XSS issue was discovered in VirtueMart before 3.2.14.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- VirtueMart 3.1.14 - Persistent Cross-Site Scripting2018-05-16 · webapps · php
Impact
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Virtuemart | Virtuemart | before 3.2.14 |
Weakness classification
References
- NVD record
- CVE.org record
- http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling
- https://imgur.com/a/Hf6JD
- https://www.exploit-db.com/exploits/44625/
- http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling
- https://imgur.com/a/Hf6JD
- https://www.exploit-db.com/exploits/44625/