CyberRota Analysis
AI-GeneratedThe xipblog module for PrestaShop versions 2.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping, allowing unauthenticated remote attackers to inject malicious JavaScript via the name and content parameters in ajax.php. This vulnerability can lead to the execution of the payload in the context of an administrator's session when comments are reviewed, potentially resulting in full compromise of the affected store. PrestaShop administrators and security teams should prioritize addressing this vulnerability to protect their systems from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting in Stored Cross-Site Scripting (XSS). When an administrator reviews comments in the back office, the payload executes with admin-level session context, leading to full store compromise.