CVE-2008-6945 Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv_order_item CGI variable parameter in Core, (2) the country-select widget, or (3) possibly the value specifier when used in the UserTag feature.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| icdevgroup interchange | = 5.4.0 | No fix listed |
| icdevgroup interchange | = 5.4.1 | No fix listed |
| icdevgroup interchange | = 5.4.2 | No fix listed |
| icdevgroup interchange | = 5.6.0 | No fix listed |
| icdevgroup interchange | = 5.7.0 | No fix listed |
References
- ftp.icdevgroup.org vendor-advisory
- 49852 vdb-entry
- 49853 vdb-entry
- 32658 third-party-advisory vendor-advisory
- www.icdevgroup.org patch vendor-advisory
- 32297 vdb-entry
- interchange-countryselectwidget-xss(46598) vdb-entry
- interchange-mvorderitem-xss(46599) vdb-entry