@WEB ShoppingCart Unspecified Cross Site Scripting Vulnerability
BID:53783
Info
@WEB ShoppingCart Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 53783 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-2631 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 05 2012 12:00AM |
| Updated: | Jun 05 2012 12:00AM |
| Credit: | Yoshinori Matsumoto of Kobe Digital Labo.,Inc |
| Vulnerable: |
WEBLOGIC CORPORATION ShoppingCart T 1.5.0.1 WEBLOGIC CORPORATION ShoppingCart 1.5.1.0 |
| Not Vulnerable: |
WEBLOGIC CORPORATION ShoppingCart 1.5.2.0 |
Discussion
@WEB ShoppingCart Unspecified Cross Site Scripting Vulnerability
@WEB ShoppingCart is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
@WEB ShoppingCart versions 1.5.10, T 1.5.0.1 and prior are vulnerable.
@WEB ShoppingCart is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
@WEB ShoppingCart versions 1.5.10, T 1.5.0.1 and prior are vulnerable.
Exploit / POC
@WEB ShoppingCart Unspecified Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.