CVE-2020-25750

HIGH

DotPlant2 < 2020-09-14 - XML External Entity Injection via Pay2PayPayment checkResult Function

Title source: llm
STIX 2.1

Description

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

References (1)

Core 1
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/DevGroup-ru/dotplant2/issues/400

Scores

CVSS v3 7.5
EPSS 0.0115
EPSS Percentile 62.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-611
Status published
Products (2)
devgroup/dotplant 0 - 2020-09-14Packagist
dotplant/dotplant2 < 2020-09-14
Published Sep 18, 2020
Tracked Since Feb 18, 2026