CVE-2020-5285: 
Prestashop vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in PrestaShop versions between 1.7.6.0 and 1.7.6.5, identified as CVE-2020-5285. The vulnerability involves the back parameter and was disclosed on April 20, 2020. The issue affects PrestaShop e-commerce platform installations within the specified version range (GitHub Advisory).

The vulnerability is classified as a reflected XSS issue, tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.1 (MEDIUM) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it requires user interaction but can be exploited remotely without authentication (NVD).

The vulnerability could allow attackers to execute malicious scripts in users' browsers through the back parameter, potentially leading to theft of sensitive information or session hijacking. The attack requires user interaction and can result in limited confidentiality and integrity impacts (NVD).

The vulnerability can be exploited by crafting a malicious URL that includes a specially formatted back parameter. The attack vector is network-accessible and requires low attack complexity, though it does need user interaction to be successful (NVD).

The vulnerability has been patched in PrestaShop version 1.7.6.5. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves proper handling of the back parameter to prevent XSS attacks (GitHub Advisory).