CVE-2007-0056

EPSS 2.6%

Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.

Affected products

n/a · n/a

public PoCs found — 6

exploitdbwww.exploit-db.com/exploits/29378unverified exploitdbwww.exploit-db.com/exploits/29377unverified exploitdbwww.exploit-db.com/exploits/29381unverified exploitdbwww.exploit-db.com/exploits/29382unverified exploitdbwww.exploit-db.com/exploits/29379unverified exploitdbwww.exploit-db.com/exploits/29380unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/32553 http://osvdb.org/32554 http://osvdb.org/32555 http://osvdb.org/32556 http://osvdb.org/32557 http://osvdb.org/32558 http://secunia.com/advisories/23547 http://securityreason.com/securityalert/2091 https://exchange.xforce.ibmcloud.com/vulnerabilities/31178 http://www.securityfocus.com/archive/1/455629/100/0/threaded http://www.securityfocus.com/bid/21845 http://www.vupen.com/english/advisories/2007/0028