Description
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Virtual Programming VP-ASP Shoperror Script 4/5 - Cross-Site Scripting EDB-24198 · webapps · Jun 14, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 11846 third-party-advisory
- http://www.providesecurity.com/research/advisories/06142004-01.asp
- 6949 vdb-entry
- 10530 vdb-entry
- 10534 vdb-entry
- http://www.vpasp.com/virtprog/info/faq_securityfixes.htm
- vpasp-shoperror-xss(16411) vdb-entry
- 20040613 VP-ASP Shopping Cart Multiple Vulnerabilities mailing-list