CVE-2012-2935: XSS
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the valuetitle parameter, a different vulnerability than CVE-2012-1059.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2935?
CVE-2012-2935 is classified as a medium severity Cross-site Scripting (XSS) vulnerability.
How do I fix CVE-2012-2935?
To fix CVE-2012-2935, it's recommended to sanitize and validate user input for the value_title parameter to prevent XSS attacks.
Which versions of OSCommerce are affected by CVE-2012-2935?
CVE-2012-2935 affects OSCommerce Online Merchant versions up to 3.0.2, as well as versions 2.2, 2.3.0, and 2.3.1.
Is CVE-2012-2935 related to any other vulnerabilities?
CVE-2012-2935 is a different vulnerability than CVE-2012-1059, although both involve XSS issues.
What type of attack can CVE-2012-2935 enable?
CVE-2012-2935 can allow remote attackers to inject arbitrary web script or HTML into the application.