Unscored CVE-2010-1590 EUVD-2010-1616GHSA-j6r3-52x6-w8pf

Cross-site scripting (XSS) vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow…

Published Apr 28, 2010 · Updated Sep 17, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in shopsessionsubs.asp in Rocksalt International VP-ASP Shopping Cart 6.50 and earlier might allow remote attackers to inject arbitrary web script or HTML via the client's DNS hostname (aka the REMOTE_HOST variable), related to the CookielessGenerateFilename and CookielessReadFile functions.

References

20100120 Insufficient User Input Validation in VP-ASP 6.50 Demo Code mailing-list