Thursday, 9 August 2007

Storesprite XSS vuln.

###############################################
Vuln. discovered by : r0t
Date: 10 August 2007
vendor:http://www.storesprite.com/
affected versions:Storesprite 7 and previous
###############################################


Storesprite contains a flaw that allows a remote Cross-Site Scripting attacks.Input passed to the "next" parameter in "secure/addaddress.php","secure/editshipdetails.php","secure/register.php",
"secure/login.php" isn't properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.


###############################################
Solution:
Edit the source code to ensure that input is properly sanitised.
###############################################

1 comment:

Mark said...

A patch is available:

The following code should be pasted into all config files before the
closing ?> tag:

//---- start xss vun patch ---
$allow_next = array("selectdeliveryaddress.php","revieworder.php");
if ($_GET[next]) {
if (!in_array("$_GET[next]", $allow_next)) {
echo "Not allowed!";
exit;
}
}
//--- end xss vun patch --