PT-2015-4938 · Zen Cart · Zencart-Ja

Shoji Baba · Published 2015-02-27 · Updated 2017-12-07 · CVE-2015-0882

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions zencart-ja versions 1.3 jp through 1.3.0.2 jp8 zencart-ja versions 1.5 ja through 1.5.1 ja

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted parameter. This is related to the files admin/includes/init includes/init sanitize.php and includes/init includes/init sanitize.php.

Recommendations For zencart-ja versions 1.3 jp through 1.3.0.2 jp8, consider restricting access to the init sanitize.php files until a patch is available. For zencart-ja versions 1.5 ja through 1.5.1 ja, avoid using crafted parameters in the affected files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-0882

Affected Products

Zencart-Ja

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-0882 · Security Note
• https://github.com/zencart-ja/zc-v1-series/commit/022949bd09444d7e58703cc537dbbd5744c381b8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0882 · Note
• http://jvn.jp/en/jp/JVN44544694/281242/index.html · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000027 · Note
• http://jvn.jp/en/jp/JVN44544694/index.html · Note