vendor:
X-Cart
by:
SecurityFocus
7.5
CVSS
HIGH
SQL Injection and Cross-Site Scripting
89, 79
CWE
Product Name: X-Cart
Affected Version From: 4.0.8
Affected Version To: 4.0.8
Patch Exists: NO
Related CWE: N/A
CPE: a:x-cart:x-cart
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2005
X-Cart SQL Injection and Cross-Site Scripting Vulnerabilities
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
Mitigation:
Input validation should be used to ensure that untrusted data is not passed to the application. Additionally, applications should use a least-privileged account with minimal access rights to the underlying database.
