CVE-2014-10035

## Vulnerability couponPHP versions before 1.2.0 contain multiple stored cross-site scripting (XSS) vulnerabilities in the admin area. The sEcho parameter in comments_paginate.php and stores_paginate.php, as well as parameters affiliate_url, description, domain, seo[description], seo[heading], seo[title], seo[keywords], setting[logo], setting[perpage], and setting[sitename] in admin/index.php, are not properly sanitized before being stored and later rendered. This allows injection of arbitrary HTML and script code [1][2].

Exploitation

An attacker with administrative access to the couponPHP admin panel can craft malicious input in any of the listed parameters. The injected payload is stored on the server and executed in the browser of any administrator who views the affected page. No additional user interaction is required beyond the victim accessing the admin interface [1][2].

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the admin session. This can lead to session hijacking, defacement, or further compromise of the couponPHP installation. The attack is limited to the admin area but can affect all administrators [1][2].

Mitigation

The vendor released version 1.2.0 to address these vulnerabilities. Users should upgrade to couponPHP 1.2.0 or later. No workarounds are documented in the available references [1][2].