Asaancart · Asaancart · CVE-2012-5330
**Name of the Vulnerable Software and Affected Versions**
asaanCart version 0.9
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various means, including the PATH INFO to specific PHP files such as `calc.php`, `chat.php`, `register.php`, or `index.php` in the `libs/smarty ajax/` directory, or by manipulating the `page` parameter in `libs/smarty ajax/index.php`.
**Recommendations**
For asaanCart version 0.9, consider disabling access to the `calc.php`, `chat.php`, `register.php`, and `index.php` files in the `libs/smarty ajax/` directory, as well as restricting the `page` parameter in `libs/smarty ajax/index.php` to minimize the risk of exploitation.