Vulnerability - cpCommerce - XSS
cpcommerce is a FOSS php-based e-commerce (shopping cart) web application.
Exploit: Javascript placed inside a user's "Full Name:" field will not be
stripped - it will be added to the database 'as-is' as long as it has no
quotations in the string. When the admin goes to the clients view page, the
javascript is executed as the rogue client's name appears.
Gravity: The attacker can potentially fetch the admin's cookie or do a vast
amount of other things.
Complication: This is very trivial to reproduce. Anyone with experience coding
javascript can presently take advantage of the admin account of any unpatched
cpcommerce shopping cart.
This is only one aspect of this cross-site scripting vulnerability. I still
have yet to test other parts of my site which have user-inputted information
such as product reviews and order forms.
I tested this with 1.1.0 (the latest version) - the OS is debian etch running
apache2, php5 and mysql5. I suspect that earlier versions of cpcommerce are
most likely also vulnerable.