CVE-2010-1464: XSS

Published Apr 16, 2010

Updated

Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currencyidleft, (2) currencyidright, (3) darkcolor, (4) lightcolor, (5) middlecolor, and (6) w parameters.

Affected Software

1 affected component

Webasyst Shop-Script

Event History

Apr 16, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue can be exploited remotely and does not require authentication. Exploitation requires sending crafted input through one of the affected parameters.

Which inputs should be reviewed for exposure?

Review handling of the currency_id_left, currency_id_right, darkcolor, lightcolor, middlecolor, and w parameters. These parameters are identified as allowing injection of arbitrary script or HTML.

CVE-2010-1464: XSS

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which inputs should be reviewed for exposure?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which inputs should be reviewed for exposure?