AlstraSoft EPay Enterprise Multiple HTML Injection Vulnerabilities

Bugtraq ID:	16055
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 23 2005 12:00AM
Updated:	Dec 23 2005 12:00AM
Credit:	Discovered by rakstija r0t3d3Vil.
Vulnerable:	AlstraSoft EPay Enterprise 3.0
Not Vulnerable:

AlstraSoft EPay Enterprise Multiple HTML Injection Vulnerabilities

EPay Enterprise is prone to multiple HTML injection vulnerabilities.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible.

EPay Enterprise 3.0 and prior are vulnerable.

AlstraSoft EPay Enterprise Multiple HTML Injection Vulnerabilities

No exploit is required.

AlstraSoft EPay Enterprise Multiple HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

AlstraSoft EPay Enterprise Multiple HTML Injection Vulnerabilities

References:

• AlstraSoft EPay Enterprise v3.0 XSS vuln. (rakstija r0t3d3Vil)
  
• EPay Enterprise (AlstraSoft)