CVE-2024-33981

Name of the Vulnerable Software and Affected Versions PayPal, Credit Card and Debit Card Payment version 1.0

Description A Cross-Site Scripting (XSS) issue allows an attacker to create a specially crafted URL and send it to a victim to obtain details of their session cookie via the start parameter in "/admin/mod reports/index.php".

Recommendations For version 1.0, consider disabling access to the "/admin/mod reports/index.php" endpoint until a patch is available. Restrict the use of the start parameter in this endpoint to minimize the risk of exploitation.