PT-2006-4417 · Garry Glendown · Garry Glendown Shopping Cart

Luny · Publicado 2006-07-13 · Atualizado 2018-10-18 · CVE-2006-3542

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Garry Glendown Shopping Cart version 0.9

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the shop name field in editshop.php, edititem.php, and index.php, and via the item field in editshop.php and edititem.php. API Endpoints:

• editshop.php
• edititem.php
• index.php Vulnerable Parameters or Variables:
• shop name
• item

Recommendations For Garry Glendown Shopping Cart version 0.9, consider validating and sanitizing user input for the shop name and item fields in the affected API endpoints to prevent XSS attacks. As a temporary workaround, restrict access to editshop.php, edititem.php, and index.php to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-3542

Produtos afetados

Garry Glendown Shopping Cart

Referências · 9

• http://securityreason.com/securityalert/1223 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3542 · Nota de Segurança
• http://securityfocus.com/archive/1/439150/100/0/threaded · Nota
• http://securityfocus.com/bid/18841 · Nota
• http://osvdb.org/27024 · Nota
• http://osvdb.org/27025 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27539 · Nota
• http://secunia.com/advisories/20957 · Nota
• http://vupen.com/english/advisories/2006/2693 · Nota