CVE-2020-5273: 
PHP vulnerability analysis and mitigation

CVE-2020-5273 affects PrestaShop module ps_linklist versions before 3.1.0. The vulnerability was discovered and disclosed in April 2020, involving a stored Cross-Site Scripting (XSS) vulnerability when using custom URLs in the module. The issue was patched in version 3.1.0 (GitHub Advisory).

The vulnerability is classified as a stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue stems from insufficient validation of custom URLs in the module, allowing for potential injection of malicious scripts (NVD).

If exploited, this vulnerability could allow attackers to store and execute malicious scripts through custom URLs, potentially leading to the compromise of user data and session information. The impact is considered moderate as it requires user interaction and authenticated access to exploit.

The vulnerability requires an authenticated user with access to the custom URL functionality. The attack complexity is considered low, but user interaction is required for successful exploitation (NVD).

The vulnerability has been fixed in version 3.1.0 of the ps_linklist module by implementing proper URL validation using Symfony's Assert\Url constraint (PrestaShop Patch). Users are advised to upgrade to version 3.1.0 or later to mitigate this security risk.