Cross-site scripting in PrestaShop - CVE-2011-4544
Published: December 1, 2011 / Updated: March 7, 2022
Vulnerability details
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in Prestashop before 1.5 when processing the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville, (6) CP, (7) Poids, (8) Action, or (9) num parameter to prestashop/modules/mondialrelay/googlemap.php; (10) the num_mode parameter to modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) the Expedition parameter to modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php; or the (12) folder or (13) name parameter to admin/ajaxfilemanager/ajax_save_text.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
How to mitigate CVE-2011-4544
Links to Public Exploits and PoC-codes
- Exploit #4191 - PrestaShop 1.4.4.1 - /admin/ajaxfilemanager/ajax_save_text.php Multiple Parameter Cross-Site Scripting (August 11, 2020)
- Exploit #4192 - PrestaShop 1.4.4.1 - /modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php Expedition Parameter Cross-Site Scripting (August 11, 2020)
- Exploit #4193 - PrestaShop 1.4.4.1 - modules/mondialrelay/googlemap.php Multiple Parameter Cross-Site Scripting (August 11, 2020)
- Exploit #4194 - PrestaShop 1.4.4.1 mondialrelay (kit_mondialrelay) - Multiple Parameter Cross-Site Scripting (August 11, 2020)