Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: e-commerce, shopping carts :: b06-4968.htm

Multiple XSS Vulnerabilities in Zen Cart 1.3.5



Multiple XSS Vulnerabilities in Zen Cart 1.3.5
Multiple XSS Vulnerabilities in Zen Cart 1.3.5



Armorize Technologies Security Advisory=0D
=0D
Advisory No:=0D
Armorize-ADV-2006-0003=0D
=0D
Date:=0D
2006/9/27=0D
=0D
Summary:=0D
Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities that are found in Zen Cart, which is a PHP e-commerce shopping program and is Built on a foundation of OScommerce GPL code. It provides an easy-to-setup and run online store.=0D
=0D
Affected Software:=0D
Zen Cart 1.3.5=0D
=0D
Vulnerability Description:=0D
Cross-Site Scripting=0D
=0D
Analysis/Impact:=0D
Privacy leakages from the client-side may lead to session hijacking, identity theft and information theft.=0D
=0D
Detection/Exploit(partial):=0D
http://www.example.com/[PATH]/login.php=0D 
http://www.example.com/[PATH]/password_forgotten.php=0D 
=0D
Protection/Solution:=0D
1. Escape every questionable URI and HTML script.=0D
2. Remove prohibited user input.=0D
=0D
Credit: Security Team at Armorize Technologies, Inc. (security@armorize.com)=0D 
=0D
Additional Information:=0D
Link to this Armorize advisory=0D
http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0002=0D 
=0D
Links to all Armorize advisories=0D
http://www.armorize.com/advisory/=0D 
=0D
Links to Armorize vulnerability database=0D
http://www.armorize.com/resources/vulnerability.php=0D 
=0D
Armorize Technologies is a software security company focused on Web application security. Our source code analysis tools provide Web application security that transcends firewalls, intrusion detection systems (IDSs), and all other signature-based security devices. Armorize's main product, CodeSecure, uses award-winning and patent-pending source code verification technology to identify vulnerabilities in Web applications during the earliest stage of the software development lifecycle.=0D
=0D
Papers on source code analysis technology from our founding team have won awards at two consecutive International World Wide Web Conferences. The latest version of CodeSecure addresses current market gaps in Web security products by helping Web developers detect vulnerabilities and choose from rapidly generated solutions. The company is headquartered in Santa Clara, California with its R&D center in Taipei, Taiwan. Find out more at http://www.armorize.com. Find out more at http://www.armorize.com. 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH