Brooky CubeCart 2.0.1/2.0.4 - 'index.php?language' Cross-Site Scripting

Author: John Cobb
type: webapps
platform: php
port: 
date_added: 2005-02-14  
date_updated: 2016-11-04  
verified: 1  
codes: CVE-2005-0443;OSVDB-14062  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 25097.txt  

source: https://www.securityfocus.com/bid/12549/info

Brooky CubeCart is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow remote attackers to disclose arbitrary files and carry out cross-site scripting attacks.

The application is reportedly susceptible to a remote directory traversal vulnerability. A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory in the context of the server.

The application is also prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This may allow for theft of cookie-based authentication credentials or other attacks.

CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues.

http://www.example.com/index.php?&language=<script>var%20test_variable=31
337;alert(test_variable);</script>