CVE-2005-3152
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php, or (3) the searchStr parameter in a viewCat action to index.php. Note: vectors (1) and (2) were later reported to affect 3.0.7-pl1.
| Software | From | Fixed in |
|---|---|---|
| devellion / cubecart | 3.0.3 | 3.0.3.x |
| devellion / cubecart | 3.0.7-pl1 | 3.0.7-pl1.x |
- http://bugs.cubecart.com/?do=details&id=363
- http://bugs.cubecart.com/?do=details&id=459
- http://lostmon.blogspot.com/2005/09/cubecart-303-multiple-variable-cross.html
- http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.html
- http://securityreason.com/securityalert/35
- http://securitytracker.com/id?1014984
- http://www.securityfocus.com/bid/14962
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24177
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime