CVE-2005-3152
CubeCart 3.0.3 - Cross-Site Scripting via redir or searchStr Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-3152. PoCs published by Lostmon.
AI-analyzed exploit summary The exploit demonstrates XSS vulnerabilities in CubeCart by injecting arbitrary script code via unsanitized user input in the 'searchStr' and 'redir' parameters. The PoC includes example URLs that trigger JavaScript execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php, or (3) the searchStr parameter in a viewCat action to index.php. Note: vectors (1) and (2) were later reported to affect 3.0.7-pl1.
Exploits (2)
The exploit demonstrates XSS vulnerabilities in CubeCart by injecting arbitrary script code via unsanitized user input in the 'searchStr' and 'redir' parameters. The PoC includes example URLs that trigger JavaScript execution in the context of the affected site.
The provided text describes a cross-site scripting (XSS) vulnerability in CubeCart, with example URLs demonstrating how arbitrary script code can be executed in the context of the affected site. It does not contain executable exploit code but serves as a technical writeup.