PT-2007-4601 · Comersus · Comersus Cart

Doz · Publicado 2007-06-21 · Atualizado 2018-10-16 · CVE-2007-3324

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Comersus Cart version 7.07

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is achieved by manipulating the redirectUrl parameter in specific API endpoints, such as (1) "comersus customerAuthenticateForm.asp" or (2) "comersus message.asp".

Recommendations For Comersus Cart version 7.07, as a temporary workaround, consider restricting access to the redirectUrl parameter in the affected API endpoints until a patch is available. Avoid using the redirectUrl parameter in the "comersus customerAuthenticateForm.asp" and "comersus message.asp" endpoints to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-3324

Produtos afetados

Comersus Cart

Referências · 10

• 🔥 https://exploit-db.com/exploits/30204 · Exploit
• 🔥 http://securityfocus.com/bid/24562 · Exploit
• 🔥 https://exploit-db.com/exploits/30205 · Exploit
• http://securityreason.com/securityalert/2819 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3324 · Nota
• http://securityfocus.com/archive/1/471837/100/0/threaded · Nota
• http://osvdb.org/36154 · Nota
• http://osvdb.org/36153 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34954 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3324 · Nota de Segurança