CVE-2020-15178: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in PrestaShop's contact form module version 1.7.7.4 and earlier versions. The vulnerability, identified as CVE-2020-15178, was disclosed on September 15, 2020. The vulnerability affects the contact form functionality in PrestaShop installations and allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the message parameter in /contactform/contactform.php (GitHub Advisory).

The vulnerability exists due to improper sanitization of user input in the contact form module. Specifically, the issue was related to the message parameter processing in the contactform.php file, where the html_entity_decode function was incorrectly used, allowing potential XSS payloads to be executed. The vulnerability was assigned a Low severity rating according to the official advisory (GitHub Advisory).

An attacker could exploit this vulnerability to inject and execute malicious JavaScript code through the contact form, potentially leading to stored cross-site scripting attacks. This could allow attackers to steal user session information, manipulate web content, or perform actions on behalf of other users (GitHub Advisory).

The vulnerability can be exploited by submitting specially crafted input through the contact form's message parameter. The attack requires no special privileges, though user interaction is necessary as the payload must be submitted through the contact form interface (GitHub Advisory).

The vulnerability was patched in version 4.3.0 of the contact form module. The fix involves proper escaping of the message content using Tools::htmlentitiesUTF8 before processing. Users are advised to upgrade to version 4.3.0 or later to protect against this vulnerability (GitHub Commit).