PT-2005-3120 · Comersus · Comersus

Diabolic Crab · Published 2005-07-10 · Updated 2016-10-18 · CVE-2005-2191

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Comersus shopping cart (affected versions not specified)

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the name parameter to "comersus backoffice listAssignedPricesToCustomer.asp" and the message parameter to "comersus backoffice message.asp" are vulnerable.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2191

Affected Products

Comersus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-2191 · Security Note
• http://securityfocus.com/bid/15251 · Note
• http://marc.info/?l=bugtraq&m=112077057001064&w=2 · Note
• http://securitytracker.com/id?1014419 · Note
• http://downloads.securityfocus.com/vulnerabilities/exploits/backoffice_mult_exp.pl · Note