Description:
Russ McRee has discovered some vulnerabilities
in WORK system e-commerce, which can be exploited by malicious people
to conduct cross-site scripting attacks.
Input passed to the "day", "month", and "year" parameters in
module/main.php is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and script code
in a user"s browser session in context of an affected site.
The vulnerabilities are confirmed in version 4.0.9. Other versions may also be affected.
Solution:
Filter malicious characters and character sequences in a web proxy.
Provided and/or discovered by:
Russ McRee
|
