Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Multiple Vulnerabilities in Cactusoft’s CactuShop 5.x
Two vulnerabilities exist in Cactusoft’s CactuShop 5.x shopping cart software, the most serious of which can cause execution of arbitrary commands on the vulnerable system.
Ken Pfeil
April 2, 2004
2 Min Read
Reported March 31, 2004 by S-Quadra.
VERSIONS AFFECTED
Cactusoft’s CactuShop 5.x
DESCRIPTION
Two vulnerabilities exist in Cactusoft’s CactuShop 5.x shopping cart software, the most serious of which can cause execution of arbitrary commands on the vulnerable system. These two vulnerabilities consist of:
a SQL Injection condition in the pages mailorder.asp and payonline.asp. An attacker who successfully exploits this vulnerability can execute commands (via the Microsoft SQL xp_cmdshell function) in the system security context.
a Cross Site Scripting vulnerability in the script largeimage.asp. By injecting specially crafted JavaScript code in the URL and tricking a user into visiting it, a potential attacker could steal the user’s session ID and access the user's personal data.
VENDOR RESPONSE
The vendor,CactuSoft, has not released a fix for these vulnerabilities.
CREDIT
Discovered byNick Gudov.
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
