PT-2005-3512 · Ecw · Ecw-Shop

John Cobb · Published 2005-08-19 · Updated 2016-10-18 · CVE-2005-2622

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ECW-Shop version 6.0.2

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the max or ctg parameters in the index.php file.

Recommendations For ECW-Shop version 6.0.2, as a temporary workaround, consider restricting access to the index.php file until a patch is available. Avoid using the max and ctg parameters in the index.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2622

Affected Products

Ecw-Shop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-2622 · Security Note
• http://secunia.com/advisories/16459 · Note
• http://marc.info/?l=bugtraq&m=112421209919985&w=2 · Note
• http://securitytracker.com/id?1014734 · Note