CVE-2020-35128: 
PHP vulnerability analysis and mitigation

Mautic before version 3.2.4 was affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-35128. The vulnerability was discovered in late 2020 and publicly disclosed on January 14, 2021. The issue affected all versions of Mautic prior to version 3.2.4, impacting both the 2.x and 3.x branches of the software (Bishop Fox Advisory).

The vulnerability allowed an authenticated attacker with permissions to manage companies to store malicious JavaScript payloads that would execute against other Mautic users, including administrators. The issue was found in the Company Name field and Social Monitoring section. The CVSS v3.1 Base Score was rated as 9.0 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) (NVD).

Upon successful exploitation, an attacker could perform actions as the target user, including changing user passwords, altering user or email addresses, or adding a new administrator to the system. The vulnerability affected multiple areas of the application, including the Dashboard's Recent Activity widget and contact management features (Bishop Fox Advisory).

The vulnerability required an authenticated user with specific permissions to exploit. The attack vector was remote, with low attack complexity, requiring low privileges and user interaction. The vulnerability could be exploited by injecting malicious JavaScript payloads into company names or Social Monitoring titles (Bishop Fox Advisory).

The recommended mitigation was to update to Mautic version 3.2.4. For users unable to update immediately, the vendor provided SQL queries to check for potential exploit attempts by searching for suspicious entries in the companies and form submissions tables (Mautic Forum).