PT-2007-4601 · Comersus · Comersus Cart

Doz · Published 2007-06-21 · Updated 2018-10-16 · CVE-2007-3324

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Comersus Cart version 7.07

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is achieved by manipulating the redirectUrl parameter in specific API endpoints, such as (1) "comersus customerAuthenticateForm.asp" or (2) "comersus message.asp".

Recommendations For Comersus Cart version 7.07, as a temporary workaround, consider restricting access to the redirectUrl parameter in the affected API endpoints until a patch is available. Avoid using the redirectUrl parameter in the "comersus customerAuthenticateForm.asp" and "comersus message.asp" endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-3324

Affected Products

Comersus Cart

References · 10

• 🔥 https://exploit-db.com/exploits/30204 · Exploit
• 🔥 http://securityfocus.com/bid/24562 · Exploit
• 🔥 https://exploit-db.com/exploits/30205 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3324 · Security Note
• http://securityreason.com/securityalert/2819 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3324 · Note
• http://securityfocus.com/archive/1/471837/100/0/threaded · Note
• http://osvdb.org/36154 · Note
• http://osvdb.org/36153 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34954 · Note