AOH :: HP Unsorted P :: B06-2464.HTM

Pre shopping mall v1.0



Pre Shopping Mall v1.0
Pre Shopping Mall v1.0



Pre Shopping Mall

Homepage:
http://www.preprojects.com/emall.asp

Description:
PRE SHOPPING MALL a power full ecommerce shopping mall solution. If you need to setup a online shop or shopping mall PRE SHOPPING MALL is your quickest solution. You can setup your Emall within few hours. Buy install and start selling your products. Very easy to installs and manage powerful administration. Receive payments either through Paypal or Authorize.net. Quickest solution for your online business.

Effected files:
search box.
detail.php
products.php

Exploits & Vulns:

XSS Vulnerabilities:

The search and login  box does not sanatize user input before generating it dynamically. This could cause XSS.

For proof of concept just try putting this in the search box:
'';!--"=&{()}'';!--"=&{()}'';!--"=&{()}'';!--"

=&{()}

More XSS Vulns:
For the XSS examples we'll use url injection with the tag: 
http://www.example.com/emall/products.php?cid=[XSS]
http://www.example.com/emall/detail.php?prodid=[XSS] 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.