Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
BID:15896
Info
Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
| Bugtraq ID: | 15896 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 15 2005 12:00AM |
| Updated: | Feb 07 2006 08:54PM |
| Credit: | rakstija r0t3d3Vil is credited with the discovery of this issue. |
| Vulnerable: |
Kryptronic ClickCartPro 5.2 Kryptronic ClickCartPro 5.1 |
| Not Vulnerable: | |
Discussion
Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
Kryptronic ClickCartPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Kryptronic ClickCartPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Exploit / POC
Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
No exploit is required.
An example URI sufficient to exploit this issue was provided:
http://www.example.com/cp-app.cgi?usr=51H4515590&rnd=577308&rrc=N&affl=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
No exploit is required.
An example URI sufficient to exploit this issue was provided:
http://www.example.com/cp-app.cgi?usr=51H4515590&rnd=577308&rrc=N&affl=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Solution / Fix
Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining the appropriate update.
Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining the appropriate update.
References
Kryptronic ClickCartPro CP-APP.CGI Cross-Site Scripting Vulnerability
References:
References:
- Ccp Update (all) - Cgi Wrapper - 01/24/2006, Information on the 01/24/2006 Updat (Kryptonic)
- ClickCartPro (CCP) XSS vuln (rakstija r0t3d3Vil)
- ClickCartPro Product Page (Kryptronic)