CVE-2004-2411

The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.19% chance of exploitation in the next 30 days, 81th percentile

Published

2005-08-18

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/24198

References

• CVE Record
• NVD entry

Related

• CVE-2004-2385
• CVE-2004-2413
• CVE-2004-2383
• CVE-2004-2416
• CVE-2004-2375
• CVE-2004-2418