Lucene search
RootSSV:61928HistoryMar 25, 2014 - 12:00 a.m.
OXID eShop 'sample-name.html'跨站脚本漏洞
2014-03-2500:00:00
Root
www.seebug.org
11
0.001 Low
EPSS
Percentile
49.2%
Bugtraq ID:66372
CVE ID:CVE-2014-2016
OXID eShop(又名OXID eSales)是一个e-commerce系统,采用PHP开发,使用MySQL来存储数据。
通过"searchtag"参数传递给tag/sample/sample-name.html的输入在返回用户之前缺少过滤，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。
0
OXID eShop 4.x
OXID eShop 5.x
OXID eShop Professional, Community或Enterprise version 4.7.11/5.0.11 and 4.8.4/5.1.4已经修复该漏洞，建议用户下载更新：
http://www.oxidforge.org/
Related
cve
cve
CVE-2014-2016
2014-03-25 18:21:48
cvelist
cvelist
CVE-2014-2016
2014-03-25 14:00:00
prion
prion
Cross site scripting
2014-03-25 18:21:00
nvd
nvd
CVE-2014-2016
2014-03-25 18:21:48
seebug
seebug
OXID eShop < 4.7.11/5.0.11 + < 4.8.4/5.1.4 - Multiple Vulnerabilities
2014-07-01 00:00:00
packetstorm
packetstorm
OXID eShop XSS / CRLF Injection
2014-03-20 00:00:00
exploitpack
exploitpack
OXID eShop 4.7.115.0.11 4.8.45.1.4 - Multiple Vulnerabilities
2014-03-20 00:00:00
zdt
zdt
OXID eShop < 4.7.11/5.0.11 + < 4.8.4/5.1.4 - Multiple Vulnerabilities
2014-03-21 00:00:00
exploitdb
exploitdb
OXID eShop < 4.7.11/5.0.11 / < 4.8.4/5.1.4 - Multiple Vulnerabilities
2014-03-20 00:00:00