Vulnerability: In PrestaShop between versions 1.7.1.0 and 1.7.6.5, there is a reflected XSS on AdminCarts page with `cartBox` parameter The problem is fixed in 1.7.6.5
Vulnerability ID: CVE-2020-5276
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-04-20
File: classes/controller/AdminController.php
Commit message: Merge pull request from GHSA-q6pr-42v5-v97q

Id must be cast in integer
Commit author: GoT

Vulnerable version (before fix):
 protected function processBulkDelete()                 $result = true;                 foreach ($this->boxes as $id) {                     /** @var $to_delete ObjectModel */                     $to_delete = new $this->className($id);                     $delete_ok = true;                     if ($this->deleted) {                         $to_delete->deleted = 1; protected function processBulkDelete()                     if ($delete_ok) {                         PrestaShopLogger::addLog(sprintf($this->l('%s deletion', 'AdminTab', false, false), $this->className), 1, null, $this->className, (int) $to_delete->id, true, (int) $this->context->employee->id);                     } else {                         $this->errors[] = $this->trans('Can\'t delete #%id%', array('%id%' => $id), 'Admin.Notifications.Error');                     }                 }                 if ($result) {

Fixed version (after fix):
 protected function processBulkDelete()                 $result = true;                 foreach ($this->boxes as $id) {                     /** @var $to_delete ObjectModel */                     $to_delete = new $this->className((int) $id);                     $delete_ok = true;                     if ($this->deleted) {                         $to_delete->deleted = 1; protected function processBulkDelete()                     if ($delete_ok) {                         PrestaShopLogger::addLog(sprintf($this->l('%s deletion', 'AdminTab', false, false), $this->className), 1, null, $this->className, (int) $to_delete->id, true, (int) $this->context->employee->id);                     } else {                         $this->errors[] = $this->trans('Can\'t delete #%id%', array('%id%' => (int) $id), 'Admin.Notifications.Error');                     }                 }                 if ($result) {

Patch:
patch: @@ -4081,7 +4081,7 @@ protected function processBulkDelete()
                 $result = true;
                 foreach ($this->boxes as $id) {
                     /** @var $to_delete ObjectModel */
-                    $to_delete = new $this->className($id);
+                    $to_delete = new $this->className((int) $id);
                     $delete_ok = true;
                     if ($this->deleted) {
                         $to_delete->deleted = 1;
@@ -4097,7 +4097,7 @@ protected function processBulkDelete()
                     if ($delete_ok) {
                         PrestaShopLogger::addLog(sprintf($this->l('%s deletion', 'AdminTab', false, false), $this->className), 1, null, $this->className, (int) $to_delete->id, true, (int) $this->context->employee->id);
                     } else {
-                        $this->errors[] = $this->trans('Can\'t delete #%id%', array('%id%' => $id), 'Admin.Notifications.Error');
+                        $this->errors[] = $this->trans('Can\'t delete #%id%', array('%id%' => (int) $id), 'Admin.Notifications.Error');
                     }
                 }
                 if ($result) {
path: classes/controller/AdminController.php