CVE-2021-39402

EUVD-2021-25761
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
Affected Products (NVD)
VendorProductVersion
maianmediamaianaffiliate
1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
https://www.maianscriptworld.co.uk/
https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
https://www.maianscriptworld.co.uk/