AOH :: HP Unsorted C :: VA1600.HTM

cpcommerce, CVE-2008-4121 Cross Site Scripting (XSS) Vulnerabilitiy
Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121
Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121

This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce,



cpCommerce is an open-source e-commerce solution that is maintained by
templates and modules. 


Assuming cpcommerce is installed on http://localhost/cpcommerce/, 
anybody could inject JavaScript:

Disclosure Timeline 2008-09-23 Vendor contacted 2008-09-23 Vendor released 1.2.4 2008-10-19 Published advisory CVE Information The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-4121 to this issue. This is a candidate for inclusion in the CVE list (, which standardizes names for security problems. Credits and copyright This vulnerability was discovered by Fabian Fingerle (published with help from Hanno Boeck [0]). It's licensed under the creative commons attribution license. Fabian Fingerle, 2008-09-04, [0] Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkj7rksACgkQ/aNqCatBq4WLcACglcv07jybfc5wu+MaR87Z9USV PswAmweNb9BpkS4pLc6Z6lOaLTHeSh8n =2C7v -----END PGP SIGNATURE-----

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to