McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Script Cross-Site Scripting Vulnerability
BID:10617
Info
McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Script Cross-Site Scripting Vulnerability
| Bugtraq ID: | 10617 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0675 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 28 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | Discovery is credited to Dr.Ponidi Haryanto <[email protected]>. |
| Vulnerable: |
McMurtrey/Whitaker & Associates Cart32 5.0 McMurtrey/Whitaker & Associates Cart32 4.4 McMurtrey/Whitaker & Associates Cart32 3.5 a Build 710 McMurtrey/Whitaker & Associates Cart32 3.5 a McMurtrey/Whitaker & Associates Cart32 3.5 Build 619 McMurtrey/Whitaker & Associates Cart32 3.5 McMurtrey/Whitaker & Associates Cart32 3.1 McMurtrey/Whitaker & Associates Cart32 3.0 McMurtrey/Whitaker & Associates Cart32 2.6 McMurtrey/Whitaker & Associates Cart32 2.5 a |
| Not Vulnerable: | |
Discussion
McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Script Cross-Site Scripting Vulnerability
Cart32 is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If a user follows this link, the hostile code renders in the web browser of the victim user. Theft of cookie-based authentication credentials and other attacks is possible.
Cart32 version 5.0 and prior are considered prone to this issue.
Cart32 is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If a user follows this link, the hostile code renders in the web browser of the victim user. Theft of cookie-based authentication credentials and other attacks is possible.
Cart32 version 5.0 and prior are considered prone to this issue.
Exploit / POC
McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Script Cross-Site Scripting Vulnerability
No exploit is required.
The following proof of concept is available:
http://www.example.com/scripts/cart32.exe/GetLatestBuilds?cart32=&lt;script&gt;alert('XSS')&lt;/script&gt;
No exploit is required.
The following proof of concept is available:
http://www.example.com/scripts/cart32.exe/GetLatestBuilds?cart32=&lt;script&gt;alert('XSS')&lt;/script&gt;
Solution / Fix
McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Script Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Script Cross-Site Scripting Vulnerability
References:
References:
- Cart32 Homepage (Cart32)