OneWorldStore OWProductDetail.ASP HTML Injection Vulnerability

Bugtraq ID:	13186
Class:	Input Validation Error
CVE:	CVE-2005-1162
Remote:	Yes
Local:	No
Published:	Apr 14 2005 12:00AM
Updated:	Jul 12 2009 12:56PM
Credit:	dcrab <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	OneWorldStore OneWorldStore
Not Vulnerable:

OneWorldStore OWProductDetail.ASP HTML Injection Vulnerability

OneWorldStore is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

OneWorldStore OWProductDetail.ASP HTML Injection Vulnerability

No exploit is required.

OneWorldStore OWProductDetail.ASP HTML Injection Vulnerability

Solution:
The vendor has addressed this issue in the latest release of the application. Please see the referenced vendor advisory on obtaining and applying updates.


OneWorldStore OneWorldStore

• OneWorldStore OneWorldStore Current
  http://oneworldstore.com/support_updates.asp

OneWorldStore OWProductDetail.ASP HTML Injection Vulnerability

References:

• OneWorldStore Homepage (OneWorldStore)
  
• OneWorldStore Security Advisories (OneWorldStore)