gp Easy CMS Minishop Plugin HTML Injection Vulnerability
14 Jul. 2012
Summary
Minishop plugin for gp Easy CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Credit:
The original article can be found at: http://www.securityfocus.com/bid/54275.
The information has been provided by Carlos Mario Penagos Hollmann.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Vendor Status:
Currently we are not aware of any vendor-supplied patches.
