Description
Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) countrycode parameter to contact.asp, USERNAME parameter to (2) gateway.asp and (3) cart.asp, and the specific parameter to (4) quote.asp and (5) buyitnow.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Ariko-Security · textwebappsasp
https://www.exploit-db.com/exploits/15448
References (7)
Core 7
Core References
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/30176
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.org/1011-exploits/aspilotpilotcart-sqlxssinject.txt
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/63053
Exploit x_refsource_misc
http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html
Exploit exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/15448
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/44698
Exploit mailing-list
x_refsource_fulldisc
http://marc.info/?l=full-disclosure&m=128913521908405&w=2
Scores
EPSS
0.0608
EPSS Percentile
90.8%
Details
CWE
CWE-79
Status
published
Products (1)
pilotcart/pilot_cart
7.3
Published
Dec 30, 2010
Tracked Since
Feb 18, 2026