osCommerce 2.2 – ‘Contact_us.php’ Cross-Site Scripting

osCommerce 2.2 – ‘Contact_us.php’ Cross-Site Scripting

漏洞ID 1054901 漏洞类型
发布时间 2005-02-15 更新时间 2005-02-15
图片[1]-osCommerce 2.2 – ‘Contact_us.php’ Cross-Site Scripting-安全小百科CVE编号 N/A
图片[2]-osCommerce 2.2 – ‘Contact_us.php’ Cross-Site Scripting-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/25105
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/12568/info

A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected Web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in osCommerce version 2.2-MS2, other versions might also be affected. 

http://www.example.com/contact_us.php?&name=1&email=1&enquiry=%3C/textarea%3E%3Cscript%3Ealert('w00t');%3C/script%3E

相关推荐: Linux C-Media PCI声音驱动程序漏洞

Linux C-Media PCI声音驱动程序漏洞 漏洞ID 1202504 漏洞类型 未知 发布时间 2003-08-27 更新时间 2003-08-27 CVE编号 CVE-2003-0699 CNNVD-ID CNNVD-200308-169 漏洞平台 …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享