← Advisories

xt:Commerce VEYTON 4.0.15 (products_name_de) Script Insertion Vulnerability

Medium

Advisory ID

ZSL-2012-5102

Release Date

23 August 2012

Vendor

xt:Commerce GmbH / xt:Commerce International Ltd. - http://www.xt-commerce.com

Affected Version

VEYTON 4.0.15 Professional/Merchant/Ultimate

CVE

N/A

Tested On

Microsoft Windows 7 Ultimate SP1 (EN), Apache 2.4.2 (Win32), PHP 5.4.4, MySQL 5.5.25a

Summary

One shop system, many shop solutions. The shop software xt:Commerce 4 is the basic framework for online shops and for merchants who install and configure their own shop.

Description

xt:Commerce suffers from a stored XSS vulnerability when parsing user input to the 'products_name_de' parameter via POST method thru '/xtAdmin/adminHandler.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

Proof of Concept

xtcommerce_xss.htmlTXT

Disclosure Timeline

N/A

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]http://packetstormsecurity.org/files/115822

[2]http://cxsecurity.com/issue/WLB-2012080213

[3]http://www.securitylab.ru/vulnerability/428790.php

[4]http://secunia.com/advisories/50373/

[5]http://www.securelist.com/en/advisories/50373