PT-2010-3215 · Dfd · Dfd Cart

Publicado 2010-04-26 · Atualizado 2010-04-27 · CVE-2010-1541

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DFD Cart versions 1.198 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the category and list quantity parameters to "index.php", and the category parameter to "your.order.php". This can lead to cross-site scripting (XSS) attacks.

Recommendations For DFD Cart versions 1.198 and earlier, avoid using the category and list quantity parameters in the "index.php" endpoint and the category parameter in the "your.order.php" endpoint until a fix is available. As a temporary workaround, consider restricting access to these endpoints to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-1541

Produtos afetados

Dfd Cart

Referências · 6

• http://holisticinfosec.org/content/view/135/45 · Nota
• http://secunia.com/advisories/38635 · Aviso do Fabricante
• http://securityfocus.com/bid/38505 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1541 · Nota de Segurança
• http://osvdb.org/62672 · Nota
• http://osvdb.org/62671 · Nota