PT-2004-1768 · Comersus · Comersus Cart

Published 2004-07-13 · Updated 2017-07-11 · CVE-2004-0681

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Comersus Cart version 5.09

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in various ASP files of Comersus Cart. These vulnerabilities allow remote attackers to execute web scripts as other users. The message parameter is specifically vulnerable to such attacks.

Recommendations For Comersus Cart version 5.09, consider restricting access to the comersus customerAuthenticateForm.asp, comersus backoffice message.asp, comersus supportError.asp, and comersus message.asp files until a patch is available. Avoid using the message parameter in these files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-0681

Affected Products

Comersus Cart

References · 6

• 🔥 https://exploit-db.com/exploits/24261 · Exploit
• 🔥 http://securityfocus.com/bid/10674 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0681 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16646 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0681 · Note
• http://marc.info/?l=bugtraq&m=108922169327403&w=2 · Note