xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.

**xxl-job-admin vulnerable to Cross Site Scripting**

Moderate severity GitHub Reviewed Published Nov 15, 2023 to the GitHub Advisory Database • Updated Nov 15, 2023

GHSA-6733-7rp7-vf3m: xxl-job-admin vulnerable to Cross Site Scripting

**Environment**

MySQL 5.7.44, XXL-Job-Admin 2.4.0  
Virtual Machine 1: Ubuntu 22.04.3 (as XXL-Job-Admin)  
Virtual Machine 2: Ubuntu 22.04.3 (as XXL-Job-Executor)

**Vulnerability Information**

During the query of /xxl-job-admin/joblog/logDetailPage, the xxl-job-admin will query the related log directly in the machine and show it in the console in HTML format even if the log appears in <script> </script> format

**Steps to reproduce the behavior**

Step 1: Modify the application log in default path of XXL-Job-Executor and add malicious javascript  
 cd /data/applogs/xxl-job/jobhandler/yyyy-mm-dd/  
  
Example malicious code  
<script>alert(Test123);</script>  

Step 2: Login to the XXL-Job-Admin console by admin user and navigate to Log Query Page  
Check the log by querying log id  

Step 3: Alert will show here

CVE-2023-48088: XSS attack appears in /xxl-job-admin/joblog/logDetailPage · Issue #3329 · xuxueli/xxl-job

Red Hat Security Advisory 2023-7216-01 - Red Hat OpenShift Service Mesh 2.4.5 Containers. Issues addressed include a cross site scripting vulnerability.

    The following data is constructed from data provided by Red Hat's json file at:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7216.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.5Advisory ID:        RHSA-2023:7216-01Product:            Red Hat OpenShift Service MeshAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:7216Issue date:         2023-11-15Revision:           01CVE Names:          CVE-2023-3978====================================================================Summary: Red Hat OpenShift Service Mesh 2.4.5 ContainersRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es):* openshift-istio-cni-rhel8-container: golang.org/x/net/html: Cross site scripting (CVE-2023-3978)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-3978References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2228689https://issues.redhat.com/browse/OSSM-3647

Red Hat Security Advisory 2023-7216-01

The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id'  parameter in versions up to, and including, 2.6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

This record contains material that is subject to copyright.

**Copyright 2012-2023 Defiant Inc.**

**License:** Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. **Read more.**

**Copyright 1999-2023 The MITRE Corporation**

**License:** CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. **Read more.**

Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments.

CVE-2023-4602: Namaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scripting — Wordfence Intelligence

The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2023-4889: Shareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode — Wordfence Intelligence

Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Search code, repositories, users, issues, pull requests...**

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

CVE-2023-47446: PHPGrukul-Pre-School-Enrollment-System-v1.0/CVE-2023-47446 PHPGurukul-Pre-School-Enrollment-System-v1.0 Stored XSS Vulnerability.md at main · termanix/PHPGrukul-Pre-School-Enrollment-System-v1.0

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-41597: EyouCms v1.6.2 存在反射型XSS漏洞 · Issue #238 · emlog/emlog

Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile.

**IMPORTANT NOTICE**: DO NOT REPORT VULNERABILITIES SOLELY TO THE AUTHOR OR MARKETPLACE.

We urge you to report any vulnerabilities directly to us. Our mission is to ensure the safety and security of the PrestaShop ecosystem. Unfortunately, many module developers may not always recognize or acknowledge the vulnerabilities in their code, whether due to lack of awareness, or inability to properly evaluate the associated risk, or other reasons.

Given the rise in professional cybercrime networks actively seeking out these vulnerabilities, it's crucial that any potential threats are promptly addressed and the community is informed. The most effective method to do this is by publishing a CVE, like the one provided below.

Should you discover any vulnerabilities, **please report them to us at: report\[@\]security-presta.org** or visit https://security-presta.org for more information.

Every vulnerability report helps make the community more secure, and we are profoundly grateful for any information shared with us.

In the module “NKM GLS” (nkmgls) up to version 3.0.1 from Nukium for PrestaShop, a guest (authenticated customer) can perform XSS injection of type 2 (stored XSS) from FRONT to BACK (F2B) of Category 2 within the funnel order in affected versions.

Note : To succeed in this exploit, the red team needs to pay to convert a cart into a valid order with GLS carrier and require the administrator of the PS to check a specific screen within its backoffice.

**Summary**

*   **CVE ID**: CVE-2023-47309
*   **Published at**: 2023-11-14
*   **Platform**: PrestaShop
*   **Product**: nkmgls
*   **Impacted release**: <= 3.0.1 (3.0.2 fixed the vulnerability)
*   **Product author**: Nukium
*   **Weakness**: CWE-79
*   **Severity**: critical (9.0)

**Description**

As all XSS type 2 (Stored XSS) F2B (Front to Back), there are two steps and a prerequisite.

Prerequisite :

*   The field phone_mobile within table gls\_cart\_carrier suffers from a type varchar(255) which is large enough to allow dangerous XSS payloads.

Steps :

*   The method NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile does not properly clean the parameter gls_customer_mobile. pSQL is useless against XSS which exploits HTML tag attributes (Category 2 according to OWASP - pSQL only neutralized Category 1 thanks to its strip\_tags).
*   The output in the backoffice is not escaped in the related smarty template that uses it.

**CVSS base metrics**

*   **Attack vector**: network
*   **Attack complexity**: low
*   **Privilege required**: low
*   **User interaction**: required
*   **Scope**: changed
*   **Confidentiality**: high
*   **Integrity**: high
*   **Availability**: high

**Vector string**: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

**Possible malicious usage**

*   Unlock design critical vulnerabilities, see this.

**Patch from 3.0.2**

    --- a/controllers/front/checkout.php
    +++ b/controllers/front/checkout.php
    
     <?php
     
    +use Nukium\GLS\Common\Exception\GlsException;
     use Nukium\GLS\Common\Legacy\GlsController;
     
     require_once dirname(__FILE__) . '/../../vendor/autoload.php';
    @@ -25,54 +26,63 @@ class NkmGlsCheckoutModuleFrontController extends ModuleFrontController
                 'message' => ''
             );
     
    -        $phone_mobile = Tools::getValue('gls_customer_mobile');
    -        $id_carrier = Tools::getValue('id_carrier');
    -        $is_relay = Tools::getValue('is_relay');
    -
    -        if ($cart && !empty($id_carrier)) {
    -            /**
    -             * Récupération du code produit GLS (dépend du transporteur sélectionné uniquement dans ce cas de figure
    -             * car l'enregistrement est appelé uniquement pour les transporteurs gls13h ou glsrelais)
    -             */
    -            $customer_address = new Address($cart->id_address_delivery);
    -            $customer_country_iso = '';
    -            if ($customer_address) {
    -                $customer_country_iso = Country::getIsoById($customer_address->id_country);
    +        try {
    +            $phone_mobile = Tools::getValue('gls_customer_mobile');
    +            if (!Validate::isPhoneNumber($phone_mobile)) {
    +                throw new GlsException($this->module->l('Please fill-in a valid mobile number (e.g. +XXXXXXXXXXX or 0XXXXXXXXX).', 'nkmgls'));
                 }
    -            $gls_product = $this->module->getGlsProductCode(
    -                (int)$id_carrier,
    -                $customer_country_iso
    -            );
     
    -            $query = new DbQuery();
    -            $query->select('c.*')
    -                ->from('gls_cart_carrier', 'c')
    -                ->where('c.`id_customer` = ' . (int) $cart->id_customer)
    -                ->where('c.`id_cart` = ' . (int) $cart->id);
    -
    -            if (Db::getInstance()->getRow($query)) {
    -                $sql = 'UPDATE ' . _DB_PREFIX_ . 'gls_cart_carrier SET `customer_phone_mobile`=\'' . pSQL($phone_mobile) . '\', `id_carrier`=' . (int) $id_carrier . ', `gls_product`=\'' . pSQL($gls_product) . '\'';
    -                // reset all data except mobile and gls_product
    -                if (! $is_relay) {
    -                    $sql .= ',`parcel_shop_id` = NULL, `name` = NULL, `address1` = NULL, `address2` = NULL, `postcode` = NULL,
    -                        `city` = NULL, `phone` = NULL, `phone_mobile` = NULL, `id_country` = NULL, `parcel_shop_working_day` = NULL';
    +            $id_carrier = Tools::getValue('id_carrier');
    +            $is_relay = Tools::getValue('is_relay');
    +
    +            if ($cart && !empty($id_carrier)) {
    +                /**
    +                 * Récupération du code produit GLS (dépend du transporteur sélectionné uniquement dans ce cas de figure
    +                 * car l'enregistrement est appelé uniquement pour les transporteurs gls13h ou glsrelais)
    +                 */
    +                $customer_address = new Address($cart->id_address_delivery);
    +                $customer_country_iso = '';
    +                if ($customer_address) {
    +                    $customer_country_iso = Country::getIsoById($customer_address->id_country);
                     }
    -                $sql .= ' WHERE `id_customer`=' . (int) $cart->id_customer . ' AND `id_cart`=' . (int) $cart->id;
    +                $gls_product = $this->module->getGlsProductCode(
    +                    (int)$id_carrier,
    +                    $customer_country_iso
    +                );
    +
    +                $query = new DbQuery();
    +                $query->select('c.*')
    +                    ->from('gls_cart_carrier', 'c')
    +                    ->where('c.`id_customer` = ' . (int) $cart->id_customer)
    +                    ->where('c.`id_cart` = ' . (int) $cart->id);
    +
    +                if (Db::getInstance()->getRow($query)) {
    +                    $sql = 'UPDATE ' . _DB_PREFIX_ . 'gls_cart_carrier SET `customer_phone_mobile`=\'' . pSQL($phone_mobile) . '\', `id_carrier`=' . (int) $id_carrier . ', `gls_product`=\'' . pSQL($gls_product) . '\'';
    +                    // reset all data except mobile and gls_product
    +                    if (! $is_relay) {
    +                        $sql .= ',`parcel_shop_id` = NULL, `name` = NULL, `address1` = NULL, `address2` = NULL, `postcode` = NULL,
    +                            `city` = NULL, `phone` = NULL, `phone_mobile` = NULL, `id_country` = NULL, `parcel_shop_working_day` = NULL';
    +                    }
    +                    $sql .= ' WHERE `id_customer`=' . (int) $cart->id_customer . ' AND `id_cart`=' . (int) $cart->id;
     
    -                if (Db::getInstance()->Execute($sql)) {
    -                    $return['result'] = true;
    -                } else {
    -                    $return['message'] = $this->module->l('Unexpected error occurred.', self::L_SPECIFIC);
    -                }
    -            } else {
    -                if (Db::getInstance()->Execute('INSERT INTO ' . _DB_PREFIX_ . 'gls_cart_carrier
    -                    (`id_customer`, `id_cart`, `id_carrier`, `gls_product`, `customer_phone_mobile`)
    -                    VALUES (' . (int) $cart->id_customer . ', ' . (int) $cart->id . ', ' . (int) $id_carrier . ', \'' . pSQL($gls_product) . '\', \'' . pSQL($phone_mobile) . '\')')) {
    -                    $return['result'] = true;
    +                    if (Db::getInstance()->Execute($sql)) {
    +                        $return['result'] = true;
    +                    } else {
    +                        throw new GlsException($this->module->l('Unexpected error occurred.', self::L_SPECIFIC));
    +                    }
                     } else {
    -                    $return['message'] = $this->module->l('Unexpected error occurred.', self::L_SPECIFIC);
    +                    if (Db::getInstance()->Execute('INSERT INTO ' . _DB_PREFIX_ . 'gls_cart_carrier
    +                        (`id_customer`, `id_cart`, `id_carrier`, `gls_product`, `customer_phone_mobile`)
    +                        VALUES (' . (int) $cart->id_customer . ', ' . (int) $cart->id . ', ' . (int) $id_carrier . ', \'' . pSQL($gls_product) . '\', \'' . pSQL($phone_mobile) . '\')')) {
    +                        $return['result'] = true;
    +                    } else {
    +                        throw new GlsException($this->module->l('Unexpected error occurred.', self::L_SPECIFIC));
    +                    }
                     }
                 }
    +        } catch (GlsException $e) {
    +            $return['result'] = false;
    +            $return['message'] = $e->getMessage();
             }
     
             header('Content-Type: application/json');
    

    --- a/views/templates/admin/gls_label/label_list.tpl
    +++ b/views/templates/admin/gls_label/label_list.tpl
    
    @@ -186,7 +186,7 @@
                                                             {l s='Mobile' mod='nkmgls'}
                                                         </label>
                                                         <div>
    -                                                        <input class="form-control" type="tel" name="mobile" value="{if !empty($tr.customer_phone_mobile)}{$tr.customer_phone_mobile}{else}{$tr.customer_phone}{/if}" required="required" />
    +                                                        <input class="form-control" type="tel" name="mobile" value="{if !empty($tr.customer_phone_mobile)}{$tr.customer_phone_mobile|escape:'html':'UTF-8'}{else}{$tr.customer_phone|escape:'html':'UTF-8'}{/if}" required="required" />
                                                         </div>
                                                     </div>
                                                     {if $tr.id_country|in_array:$cee_countries === false}
    @@ -210,10 +210,10 @@
    

**Other recommendations**

*   It’s recommended to upgrade to the latest version of the module **nkmgls**.
*   Systematically escape characters ‘ “ < and > by replacing them with HTML entities and applying strip\_tags - Smarty and Twig provide auto-escape filters : \`\`\`diff
*   Smarty: {$value.comment
    
    escape:’html’:’UTF-8’}
    
*   Twig: {{value.comment|e}}(without backslashes) \`\`\`
*   Limit to the strict minimum the length’s value in database - a database field that allow 10 characters (varchar(10)) is far less dangerous than a field that allows 40+ characters (use cases that can exploit fragmented XSS payloads are very rare)
*   Configure CSP headers (content security policies) by listing external domains allowed to load assets (such as js files) or being called in XHR transactions (Ajax).
*   If applicable: check against all your frontoffice’s uploaders, uploading files that will be served by your server that mime type application/javascript (like every .js natively) must be strictly forbidden as it must be considered as dangerous as PHP files.
*   Activate OWASP 941’s rules on your WAF (Web application firewall) - be warned that you will probably break your frontoffice/backoffice and you will need to preconfigure some bypasses against this set of rules.

**Timeline**

Date

Action

2023-02-24

Issue discovered during a code review by TouchWeb.fr

2023-02-24

Contact the author who will provide a patch within 4 hours

2023-02-24

V3.0.2 available on https://store.nukium.com/ and https://addons.prestashop.com/

2023-03-10

Recontact author about the publication of the vulnerability

2023-03-12

Author completes the diff of this present CVE and asks for a delay to publish

2023-05-05

Recontact author about the publication of the vulnerability

2023-05-17

Author ask for another delay before publication

2023-07-15

Recontact author about the publication of the vulnerability

2023-09-17

Recontact author about the publication of the vulnerability

2023-09-30

Recontact author about the publication of the vulnerability

2023-10-30

Inform the author about the publication of the vulnerability

2023-10-30

Request a CVE ID

2023-11-08

Received CVE ID

2023-11-14

Publish this security advisory

**Links**

*   Author product page
*   PrestaShop addons product page
*   National Vulnerability Database

**DISCLAIMER:** _The French Association Friends Of Presta (FOP) acts as an intermediary to help hosting this advisory. While we strive to ensure the information and advice provided are accurate, FOP cannot be held liable for any consequences arising from reported vulnerabilities or any subsequent actions taken._

CVE-2023-47309: [CVE-2023-47309] Improper Neutralization of Input During Web Page Generation in Nukium - NKM GLS module for PrestaShop

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions.

**Solution**

 No fix

No patched version is available.

Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Restrict Categories Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-47518: WordPress Restrict Categories plugin <= 2.6.4  - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions.

**Solution**

 No fix

No patched version is available. This plugin has been closed as of November 3, 2023 and is not available for download. This closure is temporary, pending a full review.

Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress SendPress Newsletters Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 4 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

Tag

#xss