osCommerce Multiple Cross-Site Scripting Vulnerabilities
BID:27726
Info
osCommerce Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 27726 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 11 2008 12:00AM |
| Updated: | Feb 12 2008 02:36AM |
| Credit: | Antonio San Martino Pace is credited with the discovery of these issues. |
| Vulnerable: |
osCommerce osCommerce 2.2 ms3 osCommerce osCommerce 2.2 ms2 060817 Update osCommerce osCommerce 2.2 ms2 05113 update osCommerce osCommerce 2.2 ms2 05112 update osCommerce osCommerce 2.2 ms2 osCommerce osCommerce 2.2 ms1 osCommerce osCommerce 2.2 cvs osCommerce osCommerce 2.1 osCommerce osCommerce 3.1 osCommerce osCommerce 3.0a3 |
| Not Vulnerable: | |
Discussion
osCommerce Multiple Cross-Site Scripting Vulnerabilities
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Initial reports do not specify which versions of the application are vulnerable; we will update this BID as more information emerges.
osCommerce is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Initial reports do not specify which versions of the application are vulnerable; we will update this BID as more information emerges.
Exploit / POC
osCommerce Multiple Cross-Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
osCommerce Multiple Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any solutions for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any solutions for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
osCommerce Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- osCommerce Homepage (osCommerce)