PT-2016-4641

Name of the Vulnerable Software and Affected Versions EC-CUBE shiro8 category freearea addition plugin plugin version 1.0 EC-CUBE itemdetail freearea addition plugin plugin version 1.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via...

Multiple shiro8 Co., Ltd. freearea_ addition_plugins for EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE plugin "categoryfreearea additionplugin" and "itemdetailfreearea additionplugin" provided by shiro8 Co., Ltd. contain a cross-site scripting vulnerability CWE-79. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the...