Online Merchant CVE-2012-1792 Cross-Site Scripting Vulnerability
BID:73527
Info
Online Merchant CVE-2012-1792 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73527 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-1792 |
| Remote: | Yes |
| Local: | No |
| Published: | May 27 2012 12:00AM |
| Updated: | May 27 2012 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
osCommerce Online Merchant 3.0.2 osCommerce Online Merchant 2.3.1 osCommerce Online Merchant 2.3.0 osCommerce Online Merchant 2.2 osCommerce Online Merchant 0 |
| Not Vulnerable: | |
Discussion
Online Merchant CVE-2012-1792 Cross-Site Scripting Vulnerability
Online Merchant is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.
Online Merchant is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.
Exploit / POC
Online Merchant CVE-2012-1792 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Online Merchant CVE-2012-1792 Cross-Site Scripting Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
References
Online Merchant CVE-2012-1792 Cross-Site Scripting Vulnerability
References:
References: