JVN#01162446
Cross-site scripting vulnerabilities in multiple Hal Networks shopping cart products
Overview
Multiple Hal Networks shopping cart software products are vulnerable to cross-site scripting.
Products Affected
Multiple shopping cart software products are affected by this vulnerability.For details, see the information provided by Hal Networks.
Description
Multiple Hal Networks shopping cart software products are vulnerable to cross-site scripting.
Impact
An arbitrary script can be executed on the user's web browser.
Solution
Update the Software
Apply the latest updates provided by the vendor.
For more information, refer to the vendor's website
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Analyzed on 2008.01.28
| Measures | Conditions | Severity |
|---|---|---|
| Access Required | Routed - can be attacked over the Internet using packets |
|
| Authentication | None - anonymous or no authentication (IP addresses do not count) |
|
| User Interaction Required | Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file |
|
| Exploit Complexity | Low - little to no expertise and/or luck required to exploit (cross-site scripting) |
|
Credit
Shuya Ueki reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory | |
| CPNI Advisory | |
| TRnotes | |
| CVE | |
| JVN iPedia |
JVNDB-2008-000006 |