EC-CUBE CVE-2013-5996 Multiple Cross Site Scripting Vulnerabilities
BID:63826
Info
EC-CUBE CVE-2013-5996 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 63826 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-5996 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 19 2013 12:00AM |
| Updated: | Nov 19 2013 12:00AM |
| Credit: | LAC Co., Ltd. |
| Vulnerable: |
EC-CUBE EC-CUBE 2.13 EC-CUBE EC-CUBE 2.12.6 EC-CUBE EC-CUBE 2.12.5 EC-CUBE EC-CUBE 2.12.4 EC-CUBE EC-CUBE 2.12.3 EC-CUBE EC-CUBE 2.12.2 EC-CUBE EC-CUBE 2.12.1 EC-CUBE EC-CUBE 2.12 EC-CUBE EC-CUBE 2.11.5 EC-CUBE EC-CUBE 2.11.3 EC-CUBE EC-CUBE 2.11.2 EC-CUBE EC-CUBE 2.11.1 EC-CUBE EC-CUBE 2.11 EC-CUBE EC-CUBE 2.12.6en EC-CUBE EC-CUBE 2.12.5en EC-CUBE EC-CUBE 2.12.4en EC-CUBE EC-CUBE 2.12.3enP2 EC-CUBE EC-CUBE 2.12.3enP1 EC-CUBE EC-CUBE 2.12.3en EC-CUBE EC-CUBE 2.11.4 |
| Not Vulnerable: |
EC-CUBE EC-CUBE 2.13.1 |
Discussion
EC-CUBE CVE-2013-5996 Multiple Cross Site Scripting Vulnerabilities
EC-CUBE is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
EC-CUBE 2.11.0 through 2.13.0 are vulnerable.
EC-CUBE is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
EC-CUBE 2.11.0 through 2.13.0 are vulnerable.