← Advisories

Squirrelcart v3.5.4 (table) Remote Cross-Site Scripting Vulnerability

Low

Advisory ID

ZSL-2013-5128

Release Date

19 February 2013

Vendor

Lighthouse Development - http://www.squirrelcart.com

Affected Version

2.0.0 - 3.5.4

CVE

N/A

Tested On

Linux, Apache, PHP, MySQL

Summary

Squirrelcart PHP Shopping Cart software is a fully customizable, robust php shopping cart, designed with the advanced developer and web novice in mind.

Description

Squirrelcart suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'table' GET parameter in the 'index.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

Proof of Concept

squirrelcart_xss.txtTXT

Disclosure Timeline

17.02.2013Vulnerability discovered.

19.02.2013Contact with the vendor.

19.02.2013Vendor responds asking more details.

19.02.2013Sent details to the vendor.

19.02.2013Vendor confirms the vulnerability.

19.02.2013Vendor releases version 3.5.5 to address this issue.

19.02.2013Coordinated public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic