Armorize Technologies Security Advisory
Advisory No:
Armorize-ADV-2006-0003
Date:
2006/9/27
Summary:
Armorize-ADV-2006-0003 discloses multiple cross-site scripting vulnerabilities
that are found in Zen Cart, which is a PHP e-commerce shopping program and is
Built on a foundation of OScommerce GPL code. It provides an easy-to-setup and
run online store.
Affected Software:
Zen Cart 1.3.5
Vulnerability Description:
Cross-Site Scripting
Analysis/Impact:
Privacy leakages from the client-side may lead to session hijacking, identity
theft and information theft.
Detection/Exploit(partial):
http://www.example.com/[PATH]/login.php
http://www.example.com/[PATH]/password_forgotten.php
Protection/Solution:
1. Escape every questionable URI and HTML script.
2. Remove prohibited user input.
Credit: Security Team at Armorize Technologies, Inc. (security@armorize.com)
Additional Information:
Link to this Armorize advisory
http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0002
Links to all Armorize advisories
http://www.armorize.com/advisory/
Links to Armorize vulnerability database
http://www.armorize.com/resources/vulnerability.php
Armorize Technologies is a software security company focused on Web application
security. Our source code analysis tools provide Web application security that
transcends firewalls, intrusion detection systems (IDSs), and all other
signature-based security devices. Armorize's main product, CodeSecure, uses
award-winning and patent-pending source code verification technology to
identify vulnerabilities in Web applications during the earliest stage of the
software development lifecycle.
Papers on source code analysis technology from our founding team have won
awards at two consecutive International World Wide Web Conferences. The latest
version of CodeSecure addresses current market gaps in Web security products by
helping Web developers detect vulnerabilities and choose from rapidly generated
solutions. The company is headquartered in Santa Clara, California with its R&D
center in Taipei, Taiwan. Find out more at http://www.armorize.com. Find out
more at http://www.armorize.com.
