CVE-2012-1059: XSS
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the valuetitle parameter, as demonstrated using the "Front" field in the shirt module.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1059?
CVE-2012-1059 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2012-1059?
To fix CVE-2012-1059, ensure you validate and sanitize user inputs, particularly those affecting the value_title parameter.
Which version of osCommerce is affected by CVE-2012-1059?
CVE-2012-1059 affects osCommerce Online Merchant version 3.0.2.
What type of vulnerability is CVE-2012-1059?
CVE-2012-1059 is a cross-site scripting (XSS) vulnerability.
How can attackers exploit CVE-2012-1059?
Attackers can exploit CVE-2012-1059 by injecting malicious scripts through the value_title parameter in the cart application.