CVE-2010-4631

Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) countrycode parameter to contact.asp, USERNAME parameter to (2) gateway.asp and (3) cart.asp, and the specific parameter to (4) quote.asp and (5) buyitnow.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html	Exploit
http://www.exploit-db.com/exploits/15448	Exploit
http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt
http://www.securityfocus.com/bid/44698	Exploit
http://secunia.com/advisories/30176	Vendor Advisory
http://marc.info/?l=full-disclosure&m=128913521908405&w=2	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/63053

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:pilotcart:pilot_cart:7.3:*:*:*:*:*:*:*

Information

Published : 2010-12-30 13:00

Updated : 2017-08-16 18:33

NVD link : CVE-2010-4631

Mitre link : CVE-2010-4631

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

pilotcart

pilot_cart

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html", "name": "http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.exploit-db.com/exploits/15448", "name": "15448", "tags": ["Exploit"], "refsource": "EXPLOIT-DB"}, {"url": "http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt", "name": "http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/44698", "name": "44698", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/30176", "name": "30176", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://marc.info/?l=full-disclosure&m=128913521908405&w=2", "name": "20101107 ASPilot Pilot Cart 7.3 multiple vulnerabilities", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/63053", "name": "pilotcart-multiple-xss(63053)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) countrycode parameter to contact.asp, USERNAME parameter to (2) gateway.asp and (3) cart.asp, and the specific parameter to (4) quote.asp and (5) buyitnow."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-4631", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2010-12-30T21:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:pilotcart:pilot_cart:7.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:33Z"}