Medium severity · published Feb 12, 2021
CVE-2021-27190
A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available
5.4
CVSS
1.6%
EPSS
No
On KEV
Description
A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Peel Shopping · Peel
9.3.0; 9.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27190
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27190
Patch
https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611
Exploit
https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS
Exploit
https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS
Product
https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7
Exploit
https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address/
More from Peel Shopping
9.1
CVE-2021-37593
PEEL Shopping version 9.4.0 allows remote SQL injection
8.8
CVE-2018-20848
Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter
6.5
CVE-2021-41672
PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php
6.5
CVE-2019-20178
Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user
4.8
CVE-2018-1000887
Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the "Site Name…