Zen Cart Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	20242
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 28 2006 12:00AM
Updated:	Oct 16 2006 05:49PM
Credit:	Armorize Technologies is credited with the discovery of these vulnerabilities.
Vulnerable:	Zen Cart Web Shopping Cart 1.3.5 Zen Cart Web Shopping Cart 1.3.2 Zen Cart Web Shopping Cart 1.2.7 Zen Cart Web Shopping Cart 1.2.6 d Zen Cart Web Shopping Cart 1.1.2 d Zen Cart Web Shopping Cart 1.3.0.2
Not Vulnerable:

Zen Cart Multiple Cross-Site Scripting Vulnerabilities

Zen Cart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zen Cart 1.3.2 and 1.3.5 are vulnerable to these issues.

Zen Cart Multiple Cross-Site Scripting Vulnerabilities

An attacker can exploit these issues via a web client.

Zen Cart Multiple Cross-Site Scripting Vulnerabilities

Solution:
Fixes are available from the vendor. Please see the references for more information on obtaining and applying fixes.

Zen Cart Multiple Cross-Site Scripting Vulnerabilities

References:

• v1.3.5 Security Alert (Zen Cart)
  
• Vendor Home Page (Zen Cart)
  
• Zero-Day XSS Security Fix (applies to all versions) (Zen Cart)
  
• Multiple XSS Vulnerabilities in Zen Cart 1.3.5 ([email protected])
  
• Re: Multiple XSS Vulnerabilities in Zen Cart 1.3.5 ([email protected])