TUCoPS :: Web :: e-commerce, shopping carts :: b06-1846.htm

NextAge Shopping Cart Software XSS
NextAge Shopping Cart Software XSS
NextAge Shopping Cart Software XSS



NextAge Shopping Cart Software XSS
-------------------------------------------------------
Aria-security.com advisory
Bug Discovered by R@1D3N (amin emami)
AminRayden@yahoo.com 
Date:25/04/2005
original advisory:http://www.aria-security.net/advisory/nextage/nextageshoppingcart.txt 
--------------------------------------------------------
Affected software description:
NextAge Shopping Cart Software
Vendor:http://www.nextagecart.com 
Vulnerability: Fake form injection 
---------------------------------------------------------
information About NextAge Shopping Cart Software:
NextAge Cart Software can be used both as a ready out-of-the-box shopping cart solution and as a powerful shopping
 cart engine for a customized web shop. NextAge Cart is an extremely powerful shopping cart
and web site builder application that allows you to customize, manage and effectively market your on-line store. 
---------------------------------------------------------
Disscution:
A remote user can conduct cross-site scripting attacks.The 'panel' script does not properly
validate user-supplied input at the username and password.So remote user can access to admin panel
----------------------------------------------------------
Exploit:
example:http://www.nextagecart.com/demo/myadmin/index.php 

action="http://[target]/[admin_Path]/index.php">

-------------- Solution: N/A ------------- Greet:A.u.r.a - outlaw - majid - behzad

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH