VP-ASP Shopping Cart ShopContent.ASP Cross-Site Scripting Vulnerability

Bugtraq ID:	24033
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2007 12:00AM
Updated:	May 17 2007 06:08PM
Credit:	John Martinelli is credited with the discovery of this vulnerability.
Vulnerable:	VP-ASP Shopping Cart 6.50
Not Vulnerable:

VP-ASP Shopping Cart ShopContent.ASP Cross-Site Scripting Vulnerability

VP-ASP Shopping Cart is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

VP-ASP Shopping Cart 6.50 is vulnerable; other versions may also be affected.

VP-ASP Shopping Cart ShopContent.ASP Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following proof of concept is available:

• /data/vulnerabilities/exploits/24033.html

VP-ASP Shopping Cart ShopContent.ASP Cross-Site Scripting Vulnerability

Solution:
NOTE: The vendor is reported to have released a patch to address this issue, but this has not been confirmed.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

VP-ASP Shopping Cart ShopContent.ASP Cross-Site Scripting Vulnerability

References:

• Vendor Homepage (VP-ASP)
  
• VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability (John Martinelli)