Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities

Title: Axis Commerce 0.8.7.2 Remote Script Insertion Vulnerabilities
Advisory ID: ZSL-2012-5115
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 30.11.2012
Summary
Powerful open source ecommerce platform.
Description
Axis Commerce suffers from multiple stored XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Vendor
Axis - http://www.axiscommerce.com
Affected Version
0.8.7.2
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.4
MySQL 5.5.25a
Vendor Status
[27.11.2012] Vulnerabilities discovered.
[28.11.2012] Initial contact with the vendor.
[29.11.2012] No reply from vendor.
[30.11.2012] Public security advisory released.
PoC
axiscommerce_xss.html
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] https://github.com/axis/axiscommerce/issues/233
[2] http://packetstormsecurity.org/files/118501
[3] http://cxsecurity.com/issue/WLB-2012120008
[4] http://1337day.com/exploit/19840
[5] http://secunia.com/advisories/51477
[6] http://xforce.iss.net/xforce/xfdb/80457
[7] http://www.securityfocus.com/bid/56781
[8] http://www.osvdb.org/show/osvdb/88114
[9] http://www.osvdb.org/show/osvdb/88115
Changelog
[30.11.2012] - Initial release
[01.12.2012] - Added reference [2], [3] and [4]
[03.12.2012] - Added reference [5]
[04.12.2012] - Added reference [6] and [7]
[07.12.2012] - Added reference [8] and [9]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk