JShop E-Commerce Suite xSearch Cross-Site Scripting Vulnerability

ID EDB-ID:23666
Type exploitdb
Reporter David Sopas Ferreira
Modified 2004-02-09T00:00:00


JShop E-Commerce Suite xSearch Cross-Site Scripting Vulnerability. CVE-2004-2084. Webapps exploit for php platform

                                            source: http://www.securityfocus.com/bid/9609/info

A vulnerability has been reported to exist in JShop E-Commerce that may allow a remote user to execute HTML or script code in a user's browser.

The issue is reported to exist due to improper sanitizing of user-supplied data. It has been reported that HTML and script code may be parsed via a URI parameter of the 'search.php' script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site.