CVE-2011-4544 Cross-site scripting in n/a
Remote attackers can inject arbitrary web script or HTML via multiple parameters in PrestaShop Mondial Relay modules, potentially stealing user data or hijacking sessions.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2011-4544?
CVE-2011-4544 is a medium-severity cross-site scripting vulnerability in Prestashop Prestashop, published on 1 Dec 2011. It can be exploited over the network, and only if a user opens a file or follows a link.
Official description
Multiple cross-site scripting (XSS) vulnerabilities in Prestashop before 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) address or (2) relativ_base_dir parameter to modules/mondialrelay/googlemap.php; the (3) relativ_base_dir, (4) Pays, (5) Ville, (6) CP, (7) Poids, (8) Action, or (9) num parameter to prestashop/modules/mondialrelay/googlemap.php; (10) the num_mode parameter to modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php; (11) the Expedition parameter to modules/mondialrelay/kit_mondialrelay/SuiviExpedition_ajax.php; or the (12) folder or (13) name parameter to admin/ajaxfilemanager/ajax_save_text.php.
Weakness: CWE-79
Which versions are affected by CVE-2011-4544?
It affects 1 product.
Products include Prestashop Prestashop.
How do I fix CVE-2011-4544?
No fix has been published for CVE-2011-4544 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2011-4544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-4544 exists.
Public exploit code: 4 Exploit-DB entries.
Other vulnerabilities in Prestashop Prestashop
Sources
Also known as GHSA-ff9m-5565-gwrj.