Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters, as demonstrated by the (1) query parameter in search.php and the (2) data parameter in search_cat.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cosmicphp | Cosmicshoppingcart | All versions |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0683.html
- http://secunia.com/advisories/20272ExploitVendor Advisory
- http://securitytracker.com/id?1016164
- http://www.osvdb.org/26090
- http://www.osvdb.org/26091
- http://www.osvdb.org/26092
- http://www.osvdb.org/26093
- http://www.securityfocus.com/bid/18709
- http://www.vupen.com/english/advisories/2006/1984Vendor Advisory
- http://www.zone-h.org/advisories/read/id=9058ExploitVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26681
- http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0683.html
- http://secunia.com/advisories/20272ExploitVendor Advisory
- http://securitytracker.com/id?1016164
- http://www.osvdb.org/26090
FAQ
What is CVE-2006-2649?
CVE-2006-2649 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in (a) search.php, (b) search_cat.php, (c) search_price.php, and (d) product_details.php in the cosmicshop directory for CosmicShoppingCart allow re...
How severe is CVE-2006-2649?
CVE-2006-2649 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-2649?
Check the references section above for vendor advisories and patch information. Affected products include: Cosmicphp Cosmicshoppingcart.