National Cyber Awareness System

Vulnerability Summary for CVE-2005-1440

Overview

Multiple cross-site scripting (XSS) vulnerabilities in ViArt Shop Enterprise 2.1.6 allow remote attackers to inject arbitrary web script or HTML via (1) various parameters to basket.php, (2) the nickname, email, topic, and message fields in forum.php, as demonstrated using forum_new_thread.php and forum_thread.php, (3) the page parameter to page.php, (4) category_id and item_id parameters to reviews.php, (5) the category_id parameter to product_details.php, (6) the category_id or search_string parameters to products.php, or (7) the rp or page parameters to news_view.php.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 13462

Hyperlink:http://www.securityfocus.com/bid/13462

External Source: OSVDB

Name: 15958

Hyperlink:http://www.osvdb.org/15958

External Source: OSVDB

Name: 15957

Hyperlink:http://www.osvdb.org/15957

External Source: OSVDB

Name: 15956

Hyperlink:http://www.osvdb.org/15956

External Source: OSVDB

Name: 15955

Hyperlink:http://www.osvdb.org/15955

External Source: OSVDB

Name: 15954

Hyperlink:http://www.osvdb.org/15954

External Source: OSVDB

Name: 15953

Hyperlink:http://www.osvdb.org/15953

External Source: OSVDB

Name: 15952

Hyperlink:http://www.osvdb.org/15952

External Source: OSVDB

Name: 15951

Type: Advisory; Exploit

Hyperlink:http://www.osvdb.org/15951

External Source: SECTRACK

Name: 1013853

Hyperlink:http://securitytracker.com/id?1013853

External Source: SECUNIA

Name: 15181

Hyperlink:http://secunia.com/advisories/15181

External Source: MISC

Name: http://lostmon.blogspot.com/2005/04/viart-shop-enterprise-multiple.html

Hyperlink:http://lostmon.blogspot.com/2005/04/viart-shop-enterprise-multiple.html