TomatoCart 1.0.1 (json.php) Remote Cross-Site Scripting Vulnerability

Risk: Low
Local: No
Remote: Yes

TomatoCart 1.0.1 (json.php) Remote Cross-Site Scripting Vulnerability Vendor: Wuxi Elootec Technology Co., Ltd. Product web page: Affected version: 1.0.1 Summary: TomatoCart is the new generation of open source shopping cart solution developed by Elootec Technology Co., Ltd. It is branched from osCommerce 3 as a separate project. Desc: TomatoCart version 1.0.1 suffers from a XSS vulnerability because input passed via the "action" parameter to json.php script is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. -------------------------------- .output -------------------------------- Warning: call_user_func() expects parameter 1 to be a valid callback, class 'toC_Json_Checkout' does not have a method '1' in \tomatocart\includes\classes\json.php on line 64 Line 64: call_user_func(array('toC_Json_' . ucfirst($module), $action)); -------------------------------- output. -------------------------------- -- ------------------- .snip ------------------- $action = $_REQUEST['action']; ------------------- snip. ------------------- Tested on: Microsoft Windows XP Professional SP3 (English) Apache 2.2.14 (Win32) MySQL 5.1.41 PHP 5.3.1 Vendor status: [01.10.2010] Vulnerability discovered. [02.10.2010] Vendor contacted. [05.10.2010] No reply from vendor. [06.10.2010] Public advisory released. Advisory ID: ZSL-2010-4968 Advisory URL: Vulnerability discovered by: Gjoko "LiquidWorm" Krstic liquidworm gmail com Zero Science Lab - Dokaz na koncept: http://tomatocart/json.php?action=1<script>prompt("Please enter your password:")</script>&module=checkout&sid=31337133713371337133731337

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top