The Faceted Search module echoes the per-language url_name value submitted in the back-office filter-template form back into an error message without escaping when the value is not a valid URL. An attacker who can get a logged-in back-office user to submit a crafted url_name obtains arbitrary JavaScript execution in the context of the shop’s admin panel.
This vulnerability affects the following application versions:
- PrestaShop 1.7.6.0 RC 1
- PrestaShop 1.7.6.0-RC.1
- PrestaShop Faceted Search 3.0.1
- PrestaShop Faceted Search 3.0.2
- PrestaShop Faceted Search 3.0.3
- PrestaShop Faceted Search 3.0.4
- PrestaShop Faceted Search 3.0.5
- PrestaShop Faceted Search 3.2.0
- PrestaShop Faceted Search 3.2.1
- PrestaShop Faceted Search 3.3.0
- PrestaShop Faceted Search 3.4.0
- PrestaShop Faceted Search 3.4.1