Vulnerability CVE-2006-3030
Published: 2006-06-15   Modified: 2012-02-12

Description:
Multiple cross-site scripting (XSS) vulnerabilities in DwZone Shopping Cart 1.1.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ToCategory and (2) FromCategory parameters to (a) ProductDetailsForm.asp and (3) UserName and (4) Password parameters to (b) LogIn/VerifyUserLog.asp.

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Dwzone -> Dwzone shopping cart 

 References:
http://xforce.iss.net/xforce/xfdb/27032
http://www.vupen.com/english/advisories/2006/2291
http://www.osvdb.org/26402
http://www.osvdb.org/26401
http://secunia.com/advisories/20603
http://pridels0.blogspot.com/2006/06/dwzone-shopping-cart-xss-vuln.html
Copyright 2024, cxsecurity.com

 

Back to Top