New Zenner
- Join Date:
- Aug 2005
- Posts:
- 52
- Plugin Contributions:
- 0
[Done v1.3.6] Cross-Site Scripting Vulnerabilities in 1.3.5
Hi,
I tried to see if this info was already posted but I did not see it. I hope I am posting it in the right place...
FYI
TITLE:
Zen Cart Cross-Site Scripting Vulnerabilities
SECUNIA ADVISORY ID:
SA22118
VERIFY ADVISORY:
http://secunia.com/advisories/22118/
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
WHERE:
From remote
SOFTWARE:
Zen Cart 1.x
http://secunia.com/product/3488/
DESCRIPTION:
Armorize Technologies has discovered some vulnerabilities in Zen Cart, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "admin_email" parameter in admin/password_forgotten.php and the "admin_name" parameter in admin/login.php isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability has been confirmed in version 1.3.5. Other versions may also be affected.
SOLUTION:
Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY:
Armorize Technologies
ORIGINAL ADVISORY: http://www.armorize.com/resources/vulnerDetail.php?cve_name=Armorize-ADV-2006-0003
