ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
BID:9244
Info
ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
| Bugtraq ID: | 9244 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 18 2003 12:00AM |
| Updated: | Dec 18 2003 12:00AM |
| Credit: | Discovery of this issue is credited to David S. Ferreira. |
| Vulnerable: |
Soft4e ECW-Shop 5.5 Soft4e ECW-Shop 5.0 1 |
| Not Vulnerable: | |
Discussion
ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
ECW-Shop is prone to cross-site scripting attacks. An attacker could exploit this issue by constructing a malicious link with hostile HTML and script code embedded in URI parameters. This code may be rendered in the browser of a user who visits the malicious link. Exploitation could allow for theft of cookie-based authentication credentials or other attacks.
ECW-Shop is prone to cross-site scripting attacks. An attacker could exploit this issue by constructing a malicious link with hostile HTML and script code embedded in URI parameters. This code may be rendered in the browser of a user who visits the malicious link. Exploitation could allow for theft of cookie-based authentication credentials or other attacks.
Exploit / POC
ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.