CubeCart 4.x.x Cross-Site Scripting Vulnerabilities
Two vulnerabilities has been discoverd in CubeCart 4.xx by Russ McRee that can be use by hackers to exploit website by cross-site scripting attacks. The search input string is not properly sanitised before passed to script for execution. This behaviour can be used by attacker to execute malicious script code in the browser to affect website. This may allow to hacker to acess administration by stealing cookies-based aunthentication scheme and destroy website.
Solution:
CubeCart has been released security patch to fix this problem that can be download from following location.
Also, CubeCart user can fix this manually by editing a single file. Please follow steps described below:
Open ini.inc.php and find at around line 134:
$data[$key] = $this->safety($val);
}
return true;
Replace with:
$data[$key] = $this->safety($val);
}
All done.
Read Related Post
You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
Leave a Reply