CVE-2014-3737 Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject ar...
LowCVSS 2.6
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the currencyUrl function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| storesprite | <= 7_24-04-13 | No fix listed |
References
- packetstormsecurity.com
- 59524 third-party-advisory
- 20140625 Reflected Cross-Site Scripting (XSS) Vulnerability in Storesprite mailing-list
- 68197 vdb-entry
- www.storesprite.com vendor-advisory
- www.htbridge.com