[HTTPCS] 1525 vulnerabilities in AsaanCart

[HTTPCS <contact () httpcs com>]

HTTPCS Advisory : HTTPCS97
Product : AsaanCart
Version : 0.9
Date : 2012-09-13
Criticality level : Less Critical
Description : A vulnerability has been discovered in AsaanCart, which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'category_name' parameter to '/category.php' is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an
affected site.
Page : /category.php
Variables : category_id=6947&category_name=[VulnHTTPCS]
Type : XSS
Method : GET
Solution :
References : https://www.httpcs.com/advisory/httpcs97
Credit : HTTPCS [Web Vulnerability Scanner]
_______________________________________________
HTTPCS Advisory : HTTPCS96
Product : AsaanCart
Version : 0.9
Date : 2012-09-13
Criticality level : Less Critical
Description : A vulnerability has been discovered in AsaanCart, which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'page_name' parameter to '/page.php' is not properly sanitised
before being returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an affected site.
Page : /page.php
Variables : page_id=1&page_name=[VulnHTTPCS]
Type : XSS
Method : GET
Solution :
References : https://www.httpcs.com/advisory/httpcs96
Credit : HTTPCS [Web Vulnerability Scanner]
_______________________________________________
HTTPCS Advisory : HTTPCS95
Product : AsaanCart
Version : 0.9
Date : 2012-09-13
Criticality level : Less Critical
Description : A vulnerability has been discovered in AsaanCart, which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'product_name' parameter to '/cart.php' is not properly sanitised
before being returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in context of an affected site.
Page : /cart.php
Variables :
qty_entered=1&mode=add&product_id=e10633542f224f7cb6f32a58d88d4989&product_name=[VulnHTTPCS]
Type : XSS
Method : GET
Solution :
References : https://www.httpcs.com/advisory/httpcs95
Credit : HTTPCS [Web Vulnerability Scanner]
_______________________________________________
Twitter : http://twitter.com/HTTPCS_
Free web vulnerability scanner HTTPCS : https://www.httpcs.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/