Description
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php. NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.
References
- ADV-2006-0227 vdb-entry
- cubecart-index-script-xss(24177) vdb-entry
- http://bugs.cubecart.com/?do=details&id=459
- 22471 vdb-entry
- 18519 third-party-advisory
- 16259 vdb-entry
- http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.html