PT-2015-3501 · Cosmoshop · Cosmoshop Epro
Published
2015-01-01
·
Updated
2015-01-02
·
CVE-2011-5305
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
CosmoShop ePRO version 10.05.00
Description
The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the
rcopy parameter to "cgi-bin/admin/rubrikadmin.cgi", the typ parameter to "cgi-bin/admin/artikeladmin.cgi", or the suchbegriff parameter to "cgi-bin/admin/shophilfe suche.cgi".Recommendations
For CosmoShop ePRO version 10.05.00, consider disabling access to the vulnerable CGI scripts until a patch is available. Restrict input for the
rcopy, typ, and suchbegriff parameters in their respective CGI scripts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cosmoshop Epro