EPay Pro Cross-Site Scripting Vulnerabilities

vendor:

EPay Pro

by:

SecurityFocus

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: EPay Pro

Affected Version From: 2

Affected Version To: 2

Patch Exists: YES

Related CWE: N/A

CPE: a:epay_pro:epay_pro:2.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

EPay Pro Cross-Site Scripting Vulnerabilities

EPay Pro is reported to be affected by various cross-site scripting vulnerabilities. These problems present themselves when malicious HTML and script code is sent to the application through multiple parameters. This issue may allow for theft of cookie-based authentication credentials or other attacks.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/12974/info

It is reported that EPay Pro is affected by various cross-site scripting vulnerabilities.

These problems present themselves when malicious HTML and script code is sent to the application through multiple parameters.

This issue may allow for theft of cookie-based authentication credentials or other attacks.

EPay Pro version 2.0 is vulnerable to these issues. 

http://www.example.com/epal/?order_num=crap&payment=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&send=first&send=regular&send=priority&send=express
Pops cookie

http://www.example.com/epal/?order_num=crap&payment=crap&send=first&send=regular&send=priority&send='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Pops cookie