osCommerce 'products_id' Parameter HTML Injection Vulnerability
BID:62997
Info
osCommerce 'products_id' Parameter HTML Injection Vulnerability
| Bugtraq ID: | 62997 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 14 2013 12:00AM |
| Updated: | Oct 16 2013 12:24AM |
| Credit: | Chris Wood of invivid |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
osCommerce 'products_id' Parameter HTML Injection Vulnerability
osCommerce is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.
Hostile HTML and script code may be injected into vulnerable sections of the application. When an unsuspecting user visits the affected site and views the affected section, the attacker-supplied code is rendered in the user's browser in the context of that site.
osCommerce 2.3.3 is vulnerable. Other versions may also be affected.
osCommerce is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.
Hostile HTML and script code may be injected into vulnerable sections of the application. When an unsuspecting user visits the affected site and views the affected section, the attacker-supplied code is rendered in the user's browser in the context of that site.
osCommerce 2.3.3 is vulnerable. Other versions may also be affected.
Exploit / POC
osCommerce 'products_id' Parameter HTML Injection Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
osCommerce 'products_id' Parameter HTML Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
osCommerce 'products_id' Parameter HTML Injection Vulnerability
References:
References:
- osCommerce Homepage (osCommerce)