Pre Shopping Mall search.php search Variable XSS

2006-05-24T07:04:15
ID OSVDB:26080
Type osvdb
Reporter luny(luny@youfucktard.com)
Modified 2006-05-24T07:04:15

Description

Vulnerability Description

PRE SHOPPING MALL contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the \'search\' variable upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user\'s browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

PRE SHOPPING MALL contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the \'search\' variable upon submission to the search.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user\'s browser within the trust relationship between the browser and the server, leading to a loss of integrity.

References:

Vendor URL: http://www.preprojects.com/emall.asp Secunia Advisory ID:20295 Related OSVDB ID: 26082 Related OSVDB ID: 26081 Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0529.html ISS X-Force ID: 26690 FrSIRT Advisory: ADV-2006-1991 CVE-2006-2669