CVE-2009-2587

EPSS 2.3%

Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to assets/js/ddcart.php, the (2) prefix parameter to includes/ajax/getstate.php, the search parameter to (3) index.php and (4) search.php, the (5) redirect parameter to login.php, and the (6) product parameter to productdetail.php.

Affected products

n/a · n/a

public PoCs found — 7

cve_referencepacketstormsecurity.org/0907-exploits/dragdopcart-xss.txtunverified exploitdbwww.exploit-db.com/exploits/34730unverified exploitdbwww.exploit-db.com/exploits/34731unverified exploitdbwww.exploit-db.com/exploits/34732unverified exploitdbwww.exploit-db.com/exploits/34734unverified exploitdbwww.exploit-db.com/exploits/34735unverified exploitdbwww.exploit-db.com/exploits/34733unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.org/0907-exploits/dragdopcart-xss.txt http://secunia.com/advisories/35925 https://exchange.xforce.ibmcloud.com/vulnerabilities/51877 http://www.osvdb.org/56065 http://www.osvdb.org/56066 http://www.osvdb.org/56067 http://www.osvdb.org/56069 http://www.osvdb.org/56070 http://www.osvdb.org/56071