Quick.Cms/Quick.Cart CVE-2012-6430 Cross Site Scripting Vulnerability

Bugtraq ID:	57254
Class:	Input Validation Error
CVE:	CVE-2012-6430
Remote:	Yes
Local:	No
Published:	Jan 09 2013 12:00AM
Updated:	Mar 19 2015 09:08AM
Credit:	High-Tech Bridge Security Research Lab
Vulnerable:
Not Vulnerable:

Quick.Cms/Quick.Cart CVE-2012-6430 Cross Site Scripting Vulnerability

Quick.Cms and Quick.Cart are prone to a cross-site scripting vulnerability because they fail to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following products are vulnerable:

Quick.Cms 5.0
Quick.Cart 6.0

Quick.Cms/Quick.Cart CVE-2012-6430 Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

The following example URI is available:

http://www.example.com/admin.php/')"></select><script>alert(document.cookie);</script>/

Quick.Cms/Quick.Cart CVE-2012-6430 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more details.

Quick.Cms/Quick.Cart CVE-2012-6430 Cross Site Scripting Vulnerability

References: