Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Full Disclosure: Full-Disclosure

[HTTPCS] 1525 vulnerabilities in AsaanCart

 

 

Full Disclosure full-disclosure RSS feed   Index | Next | Previous | View Threaded


contact at httpcs

Sep 13, 2012, 2:37 AM

Post #1 of 1 (172 views)
Permalink
[HTTPCS] 1525 vulnerabilities in AsaanCart

HTTPCS Advisory : HTTPCS97
Product : AsaanCart
Version : 0.9
Date : 2012-09-13
Criticality level : Less Critical
Description : A vulnerability has been discovered in AsaanCart, which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'category_name' parameter to '/category.php' is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an
affected site.
Page : /category.php
Variables : category_id=6947&category_name=[VulnHTTPCS]
Type : XSS
Method : GET
Solution :
References : https://www.httpcs.com/advisory/httpcs97
Credit : HTTPCS [Web Vulnerability Scanner]
_______________________________________________
HTTPCS Advisory : HTTPCS96
Product : AsaanCart
Version : 0.9
Date : 2012-09-13
Criticality level : Less Critical
Description : A vulnerability has been discovered in AsaanCart, which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'page_name' parameter to '/page.php' is not properly sanitised
before being returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an affected site.
Page : /page.php
Variables : page_id=1&page_name=[VulnHTTPCS]
Type : XSS
Method : GET
Solution :
References : https://www.httpcs.com/advisory/httpcs96
Credit : HTTPCS [Web Vulnerability Scanner]
_______________________________________________
HTTPCS Advisory : HTTPCS95
Product : AsaanCart
Version : 0.9
Date : 2012-09-13
Criticality level : Less Critical
Description : A vulnerability has been discovered in AsaanCart, which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'product_name' parameter to '/cart.php' is not properly sanitised
before being returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an affected site.
Page : /cart.php
Variables :
qty_entered=1&mode=add&product_id=e10633542f224f7cb6f32a58d88d4989&product_name=[VulnHTTPCS]
Type : XSS
Method : GET
Solution :
References : https://www.httpcs.com/advisory/httpcs95
Credit : HTTPCS [Web Vulnerability Scanner]
_______________________________________________
Twitter : http://twitter.com/HTTPCS_
Free web vulnerability scanner HTTPCS : https://www.httpcs.com/

Full Disclosure full-disclosure RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.