PT-2002-1490 · Caupo · Cauposhop+1

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0439

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CaupoShop versions 1.30a and earlier CaupoShopPro (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary Javascript, potentially leading to the theft of credit card numbers or deletion of items. This is achieved by injecting a script into new customer information fields, such as the message field.

Recommendations For CaupoShop versions 1.30a and earlier, update to a version later than 1.30a to resolve the issue. For CaupoShopPro, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0439

Affected Products

Cauposhop

Cauposhop Pro

References · 4

• http://securityfocus.com/bid/4270 · Patch
• http://iss.net/security_center/static/8431.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-0439 · Security Note
• http://securityfocus.com/archive/1/261218 · Note