CVE-2005-1486

Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trackingnum, (2) reqagree, or (3) m parameter to upstracking.php or (4) nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reported vectors but believes that they have been addressed. The original researcher is known to be unreliable.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=111530799109755&w=2
http://secunia.com/advisories/15232/	Vendor Advisory
http://www.digitalparadox.org/advisories/fishc.txt	Exploit
http://www.fishcart.org/archives/200505/msg00028.html
http://www.osvdb.org/16280
http://www.osvdb.org/16281
http://www.securityfocus.com/archive/1/457754/100/200/threaded
http://www.securityfocus.com/bid/13499	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/20384

Configurations

Configuration 1 (hide)

cpe:2.3:a:fishnet:fishcart:3.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2005-05-11 04:00

Updated : 2024-02-28 10:42

NVD link : CVE-2005-1486

Mitre link : CVE-2005-1486

CVE.ORG link : CVE-2005-1486

JSON object : View

Products Affected

fishnet

fishcart

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2005-1486", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-05-11T04:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=111530799109755&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/15232/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.digitalparadox.org/advisories/fishc.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.fishcart.org/archives/200505/msg00028.html", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/16280", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/16281", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/457754/100/200/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/13499", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20384", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trackingnum, (2) reqagree, or (3) m parameter to upstracking.php or (4) nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reported vectors but believes that they have been addressed. The original researcher is known to be unreliable."}], "lastModified": "2018-10-19T15:31:49.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fishnet:fishcart:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDBBECD9-FEE0-4D7F-B10D-BF8E5727B0E6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}