DotPlant2 Improper Restriction of XML External Entity Reference
Date: 2022-05
Affected: composer/devgroup/dotplant
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2020-25750
CWE: CWE-611
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Mitigations:

Architectural layers (MAESTRO):