Platform
php
Component
e-commerce-php
Fixed in
1.0.1
CVE-2024-13205 is a cross-site scripting (XSS) vulnerability discovered in E-Commerce-PHP version 1.0. This vulnerability allows attackers to inject malicious scripts into the application, potentially compromising user accounts and data. The affected component is the /admin/create_product.php file, specifically the 'Name' argument. A patch is available in version 1.0.1.
Successful exploitation of CVE-2024-13205 allows an attacker to inject arbitrary JavaScript code into the E-Commerce-PHP application. This can lead to a variety of malicious actions, including stealing user session cookies, redirecting users to phishing sites, or defacing the website. The impact is particularly severe if the application handles sensitive data or is used in a business-critical context. Given the publicly disclosed nature of the exploit, it is likely that attackers are actively scanning for vulnerable instances. The attack vector is remote, meaning an attacker does not need to be authenticated to exploit the vulnerability.
CVE-2024-13205 has been publicly disclosed, increasing the likelihood of exploitation. While the CVSS score is LOW (2.4), the ease of exploitation and potential impact warrant immediate attention. No KEV listing or active exploitation campaigns have been publicly reported as of the time of this writing. The vulnerability details are available on the NVD and CISA websites.
Exploit Status
EPSS
0.06% (19% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-13205 is to upgrade to version 1.0.1 of E-Commerce-PHP. If upgrading is not immediately possible, consider implementing input validation and sanitization on the 'Name' argument in the /admin/create_product.php file. This can help prevent malicious scripts from being injected. Web application firewalls (WAFs) can also be configured to block requests containing suspicious JavaScript code. Thoroughly test the upgrade in a staging environment before deploying to production to avoid breaking changes. After upgrade, confirm by attempting to create a product with a specially crafted name containing JavaScript code; it should be properly sanitized and not execute.
Update to a patched version or apply the fix provided by the vendor. If a patched version is not available, sanitize user inputs in the 'Name' field in the file /admin/create_product.php to prevent the injection of malicious code. Validate and escape data before displaying it on the page.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-13205 is a cross-site scripting (XSS) vulnerability affecting E-Commerce-PHP version 1.0, allowing attackers to inject malicious scripts via the /admin/create_product.php file.
If you are running E-Commerce-PHP version 1.0, you are potentially affected by this vulnerability. Upgrade to version 1.0.1 to mitigate the risk.
The recommended fix is to upgrade to version 1.0.1. As a temporary workaround, implement input validation and sanitization on the 'Name' parameter in /admin/create_product.php.
While no active exploitation campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Consult the E-Commerce-PHP project's official website or repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.