CVE-2021-27190

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-27190
A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 Patch Third Party Advisory
https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS Exploit Third Party Advisory
https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS Exploit Third Party Advisory
https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7 Product Vendor Advisory
https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:peel:peel_shopping:9.3.0:*:*:*:*:*:*:*
cpe:2.3:a:peel:peel_shopping:9.4.0:*:*:*:*:*:*:*
History

07 Dec 2021, 20:29

Type Values Removed Values Added
CPE cpe:2.3:a:peel:peel_shopping:9.4.0:*:*:*:*:*:*:*
References (MISC) https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7 - Product (MISC) https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7 - Product, Vendor Advisory
References (MISC) https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 - (MISC) https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 - Patch, Third Party Advisory
References (MISC) https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS - (MISC) https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS - Exploit, Third Party Advisory

17 Nov 2021, 22:17

Type Values Removed Values Added
References
  • (MISC) https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 -
  • (MISC) https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS -
Summary A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 which is publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc. A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

10 Nov 2021, 01:16

Type Values Removed Values Added
Summary A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc. A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 which is publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.
References
  • {'url': 'https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611', 'name': 'https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS', 'name': 'https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS', 'tags': [], 'refsource': 'MISC'}

03 Nov 2021, 14:15

Type Values Removed Values Added
References
  • (MISC) https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611 -

03 Nov 2021, 13:15

Type Values Removed Values Added
Summary A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 which is publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc. A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.
References
  • (MISC) https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS -
Information

Published : 2021-02-12 03:15

Updated : 2024-02-04 21:23

NVD link : CVE-2021-27190

Mitre link : CVE-2021-27190

CVE.ORG link : CVE-2021-27190

JSON object : View

Products Affected

peel

  • peel_shopping
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')