Comersus Cart Username Field HTML Injection

Medium Nessus Network Monitor Plugin ID 2796

Synopsis

The remote host is vulnerable to an HTML Injection attack.

Description

According to its banner, the remote host is running a version of Comersus Cart that fails to properly sanitize user input to the Username field. An attacker can exploit this vulnerability to cause arbitrary HTML and script code to be executed by a user's browser in the context of the affected web site when a user views the username; eg, in the admin pages.

Solution

No solution is known at this time.

Plugin Details

Severity: Medium

ID: 2796

File Name: 2796.prm

Family: CGI

Published: 2005/04/06

Modified: 2016/01/21

Dependencies: 1442, 2797

Nessus ID: 17983

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:U/RC:ND

CVSSv3

Base Score: 5.3

Temporal Score: 5.3

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS3#E:H/RL:U/RC:X

Reference Information

CVE: CVE-2005-1188, CVE-2005-1010

BID: 13000, 13125