Comersus Cart Username Field HTML Injection Vulnerability

Bugtraq ID:	13000
Class:	Input Validation Error
CVE:	CVE-2005-1010
Remote:	Yes
Local:	No
Published:	Apr 05 2005 12:00AM
Updated:	Jul 12 2009 11:56AM
Credit:	Discovery is credited to Zinho.
Vulnerable:	Comersus Open Technologies Comersus Cart 6.0.3
Not Vulnerable:

Comersus Cart Username Field HTML Injection Vulnerability

Comersus Cart is affected by a remote HTML injection vulnerability.

The problem presents itself when a malicious user enters HTML and script code through the Username field of the affected application. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Comersus Cart 6.03 is affected by this issue. Other versions may be vulnerable as well.

Comersus Cart Username Field HTML Injection Vulnerability

No exploit is required to leverage this issue.

Comersus Cart Username Field HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Comersus Cart Username Field HTML Injection Vulnerability

References:

• Comersus Cart Homepage (Comersus Open Technologies)