Home page logo

bugtraq logo Bugtraq mailing list archives

NextAge Shopping Cart Software XSS
From: AminRayden () yahoo com
Date: 25 Apr 2006 02:21:21 -0000

NextAge Shopping Cart Software XSS
Aria-security.com advisory
Bug Discovered by R () 1D3N (amin emami)
AminRayden () yahoo com
original advisory:http://www.aria-security.net/advisory/nextage/nextageshoppingcart.txt
Affected software description:
NextAge Shopping Cart Software
Vulnerability: Fake form injection <Xss>
information About NextAge Shopping Cart Software:
NextAge Cart Software can be used both as a ready out-of-the-box shopping cart solution and as a powerful shopping
 cart engine for a customized web shop. NextAge Cart is an extremely powerful shopping cart
and web site builder application that allows you to customize, manage and effectively market your on-line store. 
A remote user can conduct cross-site scripting attacks.The 'panel' script does not properly
validate user-supplied input at the username and password.So remote user can access to admin panel

<form method="pst" action="http://[target]/[admin_Path]/index.php";>
<input type="text" name="txtuserid" class="INPUT" size="30" value="xss injection code">
<input type="password" name="txtpass" class="INPUT" size="30" value="xss injection code">
<input <input type="submit" value="submit" class="button">


Greet:A.u.r.a - outlaw - majid - behzad

  By Date           By Thread  

Current thread:
  • NextAge Shopping Cart Software XSS AminRayden (Apr 25)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]