CVE-2007-0056 Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) as...
MediumCVSS 6.8
EPSS 2.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ashopsoftware ashop administration panel | All versions | No fix listed |
| ashopsoftware ashop deluxe | = 4.5 | No fix listed |
References
- 32553 vdb-entry
- 32554 vdb-entry
- 32555 vdb-entry
- 32556 vdb-entry
- 32557 vdb-entry
- 32558 vdb-entry
- 23547 third-party-advisory
- 2091 third-party-advisory
- 20070101 AShop Shopping Cart Multiple XSS Vulnerabilities mailing-list
- 21845 vdb-entry
- ADV-2007-0028 vdb-entry
- ashop-multiple-scripts-xss(31178) vdb-entry