PT-2010-3215 · Dfd · Dfd Cart

Published 2010-04-26 · Updated 2010-04-27 · CVE-2010-1541

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions DFD Cart versions 1.198 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the category and list quantity parameters to "index.php", and the category parameter to "your.order.php". This can lead to cross-site scripting (XSS) attacks.

Recommendations For DFD Cart versions 1.198 and earlier, avoid using the category and list quantity parameters in the "index.php" endpoint and the category parameter in the "your.order.php" endpoint until a fix is available. As a temporary workaround, consider restricting access to these endpoints to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-1541

Affected Products

Dfd Cart

References · 6

• http://secunia.com/advisories/38635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1541 · Security Note
• http://holisticinfosec.org/content/view/135/45 · Note
• http://securityfocus.com/bid/38505 · Note
• http://osvdb.org/62672 · Note
• http://osvdb.org/62671 · Note