osCommerce 2.2 - 'manufacturers_id' Cross-Site Scripting

EDB-ID:

23463

CVE:


Author:

JeiAr

Type:

webapps

Platform:

PHP

Published:

2003-12-22

source: https://www.securityfocus.com/bid/9277/info

A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in certain URI parameters passed to the default.php script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site. 

http://www.example.com/default.php?manufacturers_id="><iframe src=http://www.gulftech.org>