Comersus Cart Username Field HTML Injection

Medium Nessus Network Monitor Plugin ID 2796


The remote host is vulnerable to an HTML Injection attack.


According to its banner, the remote host is running a version of Comersus Cart that fails to properly sanitize user input to the Username field. An attacker can exploit this vulnerability to cause arbitrary HTML and script code to be executed by a user's browser in the context of the affected web site when a user views the username; eg, in the admin pages.


No solution is known at this time.

Plugin Details

Severity: Medium

ID: 2796

File Name: 2796.prm

Family: CGI

Published: 2005/04/06

Modified: 2016/01/21

Dependencies: 1442, 2797

Nessus ID: 17983

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:U/RC:ND


Base Score: 5.3

Temporal Score: 5.3


Temporal Vector: CVSS3#E:H/RL:U/RC:X

Reference Information

CVE: CVE-2005-1188, CVE-2005-1010

BID: 13000, 13125