SoftMaker Shop Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	16471
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 02 2006 12:00AM
Updated:	Feb 07 2006 08:53PM
Credit:	[email protected] is credited with the discovery of these vulnerabilities.
Vulnerable:	Softmaker Shop 0
Not Vulnerable:

SoftMaker Shop Multiple Cross-Site Scripting Vulnerabilities

SoftMaker Shop is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

SoftMaker Shop Multiple Cross-Site Scripting Vulnerabilities


No exploit is required.

An example URI has been provided:

http://www.example.com/shop/handle/varer/sok/resultat.asp?strSok=

%3CIMG+SRC%3Djavascript%3Aalert%28%26quot%3BXSS%26quot%3B%29%3E&valg=varer

SoftMaker Shop Multiple Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SoftMaker Shop Multiple Cross-Site Scripting Vulnerabilities

References:

• Softmaker Shop Web Site (Softmaker)
  
• SoftMaker Shop is vulnerable to XSS ([email protected])