CVE-2017-6099 PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability
MediumCVSS 6.1
EPSS 1.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paypal/merchant-sdk-php(Packagist) | >= 3.0.0, < 3.12.0 | 3.12.0 |
| paypal/merchant-sdk-php(Packagist) | = v3.10.0 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.11.0 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.4.102 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.5.103 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.6.106 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.8.106 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.8.107 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.9.0 | No fix listed |
| paypal/merchant-sdk-php(Packagist) | = v3.9.1 | No fix listed |
| paypal/merchant-sdk-php | = 3.9.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- github.com exploit
- 96432 third-party-advisory vdb-entry
- github.com