vendor:
Arab Cart
by:
indoushka
7,5
CVSS
HIGH
XSS, SQL Injection, Blind SQL/XPath Injection
79, 89, 643
CWE
Product Name: Arab Cart
Affected Version From: 1.0.2.0
Affected Version To: 1.0.2.0
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux
2010
Arab Cart Version 1.0.2.0 Mullti Vulnerability
The vulnerability exists due to insufficient validation of user-supplied input in 'id' parameter of 'showimg.php' script. A remote attacker can execute arbitrary HTML and script code in browser in context of the vulnerable website. Also, an attacker can inject arbitrary SQL commands to the application. Additionally, an attacker can inject arbitrary XPath commands to the application.
Mitigation:
Input validation should be used to prevent the exploitation of this vulnerability. Also, it is recommended to use prepared statements when interacting with the database.
