CVE-2005-3152

CubeCart 3.0.3 - XSS

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php, or (3) the searchStr parameter in a viewCat action to index.php. Note: vectors (1) and (2) were later reported to affect 3.0.7-pl1.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Lostmon · textwebappsphp
https://www.exploit-db.com/exploits/26303
exploitdb WRITEUP VERIFIED
by Lostmon · textwebappsphp
https://www.exploit-db.com/exploits/26304

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/24177
Various Sources x_refsource_confirm
http://bugs.cubecart.com/?do=details&id=363
Various Sources x_refsource_misc
http://bugs.cubecart.com/?do=details&id=459
Exploit vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1014984
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/35
Exploit, Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/14962

Scores

EPSS 0.0640
EPSS Percentile 91.1%

Details

Status published
Products (2)
devellion/cubecart 3.0.3
devellion/cubecart 3.0.7-pl1
Published Oct 05, 2005
Tracked Since Feb 18, 2026