WebAsyst Shop-Script PREMIUM 'searchstring' Parameter Cross Site Scripting Vulnerability
BID:43380
Info
WebAsyst Shop-Script PREMIUM 'searchstring' Parameter Cross Site Scripting Vulnerability
| Bugtraq ID: | 43380 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 27 2009 12:00AM |
| Updated: | Jul 27 2009 12:00AM |
| Credit: | u.f. |
| Vulnerable: |
WebAsyst Shop-Script Premium |
| Not Vulnerable: | |
Discussion
WebAsyst Shop-Script PREMIUM 'searchstring' Parameter Cross Site Scripting Vulnerability
Shop-Script PREMIUM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Shop-Script PREMIUM is vulnerable; other versions may be affected.
Shop-Script PREMIUM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Shop-Script PREMIUM is vulnerable; other versions may be affected.
Exploit / POC
WebAsyst Shop-Script PREMIUM 'searchstring' Parameter Cross Site Scripting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URI is available:
To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URI is available:
References
WebAsyst Shop-Script PREMIUM 'searchstring' Parameter Cross Site Scripting Vulnerability
References:
References:
- Shop-Script PREMIUM - Homepage (WebAsyst)