CVE-2005-1486
FishCart 3.1 - Cross-Site Scripting via Trackingnum, Reqagree, M, or Nlst Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-1486. PoCs published by Dcrab.
AI-analyzed exploit summary This exploit demonstrates multiple XSS and SQL injection vulnerabilities in FishCart by injecting malicious scripts into URL parameters. The PoC shows how unsanitized input can lead to arbitrary script execution in a user's browser.
Description
Multiple cross-site scripting vulnerabilities in FishCart 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) trackingnum, (2) reqagree, or (3) m parameter to upstracking.php or (4) nlst parameter to display.php. NOTE: the vendor was not able to reproduce some of the reported vectors but believes that they have been addressed. The original researcher is known to be unreliable.
Exploits (2)
This exploit demonstrates multiple XSS and SQL injection vulnerabilities in FishCart by injecting malicious scripts into URL parameters. The PoC shows how unsanitized input can lead to arbitrary script execution in a user's browser.
This exploit demonstrates SQL injection and XSS vulnerabilities in FishCart by injecting malicious input into the 'nlst' parameter. The PoC includes a script tag to execute arbitrary JavaScript, confirming the XSS vulnerability.