header-logo
Suggest Exploit
vendor:
osCommerce
by:
SecurityFocus
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: osCommerce
Affected Version From: 2.2 Milestone 1
Affected Version To: 2.2 Milestone 2
Patch Exists: YES
Related CWE: N/A
CPE: oscommerce
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

osCommerce Cross-Site Scripting Vulnerability

It has been reported that osCommerce may be prone to a cross-site scripting vulnerability that may allow an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser. Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in web applications.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/9238/info

It has been reported that osCommerce may be prone to a cross-site scripting vulnerability that may allow an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Although unconfirmed, osCommerce versions 2.2 Milestone 1 and 2.2 Milestone 2 may be vulnerable to this issue. 

https://www.example.com/?osCsid="><iframe src=http://www.example.com></iframe>

Navigation

Suggest Exploit

Services By CQR