Description
Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter in a search.quick action to search.php and (2) the name parameter in a sendtofriend action to sendtofriend.php.
References
- http://cpcommerce.cpradio.org/
- 1021070 vdb-entry
- 20081019 Cross Site Scripting (XSS) Vulnerabilitiy in cpcommerce, CVE-2008-4121 mailing-list
- 31825 vdb-entry
- 32353 third-party-advisory
- 4448 third-party-advisory
- cpcommerce-search-sendtofriend-xss(45970) vdb-entry
- http://www.datensalat.eu/~fabian/cve/CVE-2008-4121-cpcommerce.html