CVE-2005-1162
OneWorldStore - Stored Cross-Site Scripting via owContactUs.asp sEmail Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-1162. PoCs published by Dcrab.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in OneWorldStore by injecting a malicious script via the 'bSub' parameter in the URL. The script executes arbitrary JavaScript in the context of the user's browser session.
Description
Multiple cross-site scripting (XSS) vulnerabilities in OneWorldStore allow remote attackers to inject arbitrary web script or HTML via the (1) sEmail parameter to owContactUs.asp, (2) bSub parameter to owListProduct.asp, or the (3) Name, (4) Email, or (5) Comment fields in owProductDetail.asp.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in OneWorldStore by injecting a malicious script via the 'bSub' parameter in the URL. The script executes arbitrary JavaScript in the context of the user's browser session.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in OneWorldStore by injecting arbitrary JavaScript code via the `sEmail` parameter in the contact form. The PoC uses a crafted URL to execute an alert box displaying the user's cookies, proving the vulnerability.