PT-2006-4417 · Garry Glendown · Garry Glendown Shopping Cart

Luny · Published 2006-07-13 · Updated 2018-10-18 · CVE-2006-3542

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Garry Glendown Shopping Cart version 0.9

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible via the shop name field in editshop.php, edititem.php, and index.php, and via the item field in editshop.php and edititem.php. API Endpoints:

• editshop.php
• edititem.php
• index.php Vulnerable Parameters or Variables:
• shop name
• item

Recommendations For Garry Glendown Shopping Cart version 0.9, consider validating and sanitizing user input for the shop name and item fields in the affected API endpoints to prevent XSS attacks. As a temporary workaround, restrict access to editshop.php, edititem.php, and index.php to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-3542

Affected Products

Garry Glendown Shopping Cart

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-3542 · Security Note
• http://securityreason.com/securityalert/1223 · Note
• http://securityfocus.com/archive/1/439150/100/0/threaded · Note
• http://securityfocus.com/bid/18841 · Note
• http://osvdb.org/27024 · Note
• http://osvdb.org/27025 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27539 · Note
• http://secunia.com/advisories/20957 · Note
• http://vupen.com/english/advisories/2006/2693 · Note