osCommerce 2.2 - osCsid Cross-Site Scripting

2003-12-17T00:00:00
ID EXPLOITPACK:B3FA1262E7E71B98DF5A1232F4F3F2C3
Type exploitpack
Reporter JeiAr
Modified 2003-12-17T00:00:00

Description

osCommerce 2.2 - osCsid Cross-Site Scripting

                                        
                                            source: https://www.securityfocus.com/bid/9238/info

It has been reported that osCommerce may be prone to a cross-site scripting vulnerability that may allow an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Although unconfirmed, osCommerce versions 2.2 Milestone 1 and 2.2 Milestone 2 may be vulnerable to this issue. 

https://www.example.com/?osCsid="><iframe src=http://www.example.com></iframe>