|
|
| |
| Aktivate is a complete, end-to-end e-commerce solution aimed at Linux and other UNIXes. Aktivate is targeted at small to medium sized businesses or charities who want to accept credit card payments over the web. A security vulnerability in the product allows attackers to cause the program to allow posting of HTML and JavaScript code into existing web page. |
| |
Credit:
The information has been provided by Tamer Sahin.
|
| |
Vulnerable systems:
Aktivate version 1.03
This vulnerability allows writing scripts on vulnerable sites & application, stealing cookies, performing actions on behalf of user or modifying look of content on site.
Example:
https://host/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551
089&desc=<IMG%20height=47%20src="http://www.tamersahin.net/images/titl
e.gif"%20width=406%20border=0>
https://host/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551
089&desc=<script>alert(document.domain)</script>
|
|
|
