Reflected Cross-Site Scripting in PrestaShop Faceted Search Filter Templates

The Faceted Search module echoes the per-language url_name value submitted in the back-office filter-template form back into an error message without escaping when the value is not a valid URL. An attacker who can get a logged-in back-office user to submit a crafted url_name obtains arbitrary JavaScript execution in the context of the shop's admin... Weiterlesen