what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

CubeCart 5.x Cross Site Scripting

CubeCart 5.x Cross Site Scripting
Posted Jan 1, 2013
Authored by Aung Khant | Site yehg.net

CubeCart version 5.x suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | accbb17410aceab756c3147af4bba94fa85bf2f5d58ad85d191e7bacd737d785

CubeCart 5.x Cross Site Scripting

Change Mirror Download
1. OVERVIEW

CubeCart 5.x versions are vulnerable to Cross Site Scripting.


2. BACKGROUND

CubeCart is an "out of the box" ecommerce shopping cart software
solution which has been written to run on servers that have PHP &
MySQL support. With CubeCart you can quickly setup a powerful online
store which can be used to sell digital or tangible products to new
and existing customers all over the world.


3. VULNERABILITY DESCRIPTION

Multiple parameters are not properly sanitized, which allows attacker
to conduct Cross Site Scripting attack. This may allow an attacker to
create a specially crafted URL that would execute arbitrary script
code in a victim's browser.


4. VERSIONS AFFECTED

5.x


5. Affected URLs and Parameters

/admin.php (report[date][from] parameter]
/admin.php (report[date][to] parameter)
/index.php (review[email] parameter)
/index.php (review[name] parameter)
/index.php (review[title] parameter)
/admin.php (report[date][from] parameter)


6. SOLUTION

The vendor has chosen not to fix the issue.


7. VENDOR

CubeCart Development Team
http://cubecart.com/


8. CREDIT

Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.


9. DISCLOSURE TIME-LINE

2012-12-22: Vulnerability disclosed
2012-12-24: The vendor replied that the fix would not be implemented.
2013-01-01: Vulnerability disclosed


10. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/%5Bcubecart_5x%5D_xss
CubeCart Home Page: http://cubecart.com/

#yehg [2013-01-01]
---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close