Login Request a demo
Unscored severity · published Dec 31, 2004
CVE-2004-2411
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site…
–
CVSS
2.2%
EPSS
No
On KEV
Description
The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VP
Vp-asp · Virtual Programming
4.0; 4.50; 5.0 · source: NVD
Affected product
VP
Vp-asp
Virtual Programming
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2411
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2411
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0363.html
Vendor Advisory
http://secunia.com/advisories/11846
www.osvdb.org
http://www.osvdb.org/6949
Exploit
http://www.providesecurity.com/research/advisories/06142004-01.asp
Patch
http://www.securityfocus.com/bid/10530
Exploit
http://www.securityfocus.com/bid/10534
More from Vp-asp
–
CVE-2007-0225
Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg…
–
CVE-2007-0224
SQL injection vulnerability in shopgiftregsearch.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginLastname…
–
CVE-2006-2263
SQL injection vulnerability in shopcurrency.asp in VP-ASP 6.00 allows remote attackers to execute arbitrary SQL commands via the cid parameter
–
CVE-2005-3685
Cross-site scripting (XSS) vulnerability in shopadmin.asp in VP-ASP Shopping Cart 5.50 allows remote attackers to inject arbitrary web script or HTML via the UserName parameter
–
CVE-2004-2413
SQL injection vulnerability in VP-ASP Shopping Cart 4.0 through 5.0 allows remote attackers to execute arbitrary SQL commands via the (1) Processed0 and (2) Processed1 parameters…