28662Third-party advisory
http://secunia.com/advisories/28662 CVE-2008-0547
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
Record summary
CVE-2008-0547 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.
Description
Cross-site scripting (XSS) vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBCandyPress eCommerce suite 4.1.1.26 - Multiple VulnerabilitiesExploitDB exploitby BugReport.IRNot analyzed1 file
References
93600Third-party advisory
http://securityreason.com/securityalert/3600 candypress.comConfirmation
http://www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1 20080125 [CandyPress] eCommerce suite (SQL Injection + XSS + Path Disclosuremailing list
http://www.securityfocus.com/archive/1/487058/100/0/threaded 27454vdb entry
http://www.securityfocus.com/bid/27454 ADV-2008-0314vdb entry
http://www.vupen.com/english/advisories/2008/0314 ecommercesuite-utilitiesconfighelp-xss(39940)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/39940 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-0547 4988exploit
https://www.exploit-db.com/exploits/4988