F-Secure
Tools
Avactis Shopping Cart "checkout.php" Cross-Site Scripting
| Report ID: | SA31768 |
| Source: | Secunia |
| Date of Discovery: | 08.09.2008 |
| Criticality: | Low |
| Affects: | Avactis Shopping Cart 1.x |
| Compromise From: | From remote |
| Compromise Type: | Cross site scripting |
Summary
Two vulnerabilities has been discovered in Avactis Shopping Cart, which can be exploited by malicious people to conduct cross-site scripting attacks.
Detailed Description
Two vulnerabilities has been discovered in Avactis Shopping Cart, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "step_id" and "CHECKOUT_CZ_BLOWFISH_KEY" parameters in checkout.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are confirmed in version 1.8.1 free edition and reported in version 1.8.0. Other versions may also be affected.
Input passed to the "step_id" and "CHECKOUT_CZ_BLOWFISH_KEY" parameters in checkout.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are confirmed in version 1.8.1 free edition and reported in version 1.8.0. Other versions may also be affected.
Solution
Apply the vendor's approved patch:
http://www.avactis.com/forums/index.php?showtopic=3577
http://www.avactis.com/forums/index.php?showtopic=3577