osCommerce 2.1/2.2 – Error_Message Cross-Site Scripting

osCommerce 2.1/2.2 – Error_Message Cross-Site Scripting

漏洞ID 1053772 漏洞类型
发布时间 2003-03-20 更新时间 2003-03-20
图片[1]-osCommerce 2.1/2.2 – Error_Message Cross-Site Scripting-安全小百科CVE编号 N/A
图片[2]-osCommerce 2.1/2.2 – Error_Message Cross-Site Scripting-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22391
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7151/info

It has been reported that osCommerce does not sufficiently filter URI parameters supplied to multiple osCommerce scripts. 

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running osCommerce. 

This may allow for theft of cookie-based authentication credentials and other attacks.

This vulnerability was reported to affect osCommerce version 2.2ms1, prior versions are reportedly affected.

http://www.example.com/default.php?error_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E

相关推荐: RealOne Player SMIL File Heap Corruption Vulnerability

RealOne Player SMIL File Heap Corruption Vulnerability 漏洞ID 1101230 漏洞类型 Boundary Condition Error 发布时间 2002-11-22 更新时间 2002-11-22 …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享