CVE-2021-39402

MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
VendorProductVersion
maianmediamaianaffiliate
1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
https://www.maianscriptworld.co.uk/
https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
https://www.maianscriptworld.co.uk/