JShop E-Commerce Suite xSearch Cross-Site Scripting Vulnerability

                                                source: http://www.securityfocus.com/bid/9609/info

A vulnerability has been reported to exist in JShop E-Commerce that may allow a remote user to execute HTML or script code in a user's browser.

The issue is reported to exist due to improper sanitizing of user-supplied data. It has been reported that HTML and script code may be parsed via a URI parameter of the 'search.php' script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site.

search.php?xSearch=%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscrip%3E&submit=Search