CVE-2020-26225: 
PHP vulnerability analysis and mitigation

In PrestaShop Product Comments module before version 4.2.0, a reflected Cross-Site Scripting (XSS) vulnerability was discovered that could allow attackers to inject malicious web code into users' browsers. The vulnerability was assigned CVE-2020-26225 and was disclosed on November 16, 2020. The affected versions are >4.0.0 and before 4.2.0 of the Product Comments module (GitHub Advisory).

The vulnerability exists in the PostComment functionality of the Product Comments module. An attacker could exploit this by creating a malicious link containing crafted parameters that would execute arbitrary JavaScript code in the victim's browser when clicked. The issue was caused by insufficient validation of user input in the module's parameters (GitHub Advisory).

The vulnerability allows attackers to inject malicious web code into users' browsers through specially crafted links. This could potentially lead to session hijacking, credential theft, or other client-side attacks against users who click on malicious links (GitHub Advisory).

The vulnerability can be exploited by creating malicious links containing crafted parameters that trigger the XSS payload when clicked by users. The attack vector requires user interaction in the form of clicking a malicious link (GitHub Advisory).

The vulnerability has been patched in version 4.2.0 of the Product Comments module. Users are advised to upgrade to this version or later to protect against this vulnerability. The fix includes improved input validation and proper encoding of parameters (GitHub Advisory).