bugtraq - [CVE-2012-6458] Multiple Persistent XSS in silverstripe-ecommerce

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAJPzsLN2PUKUyREXJBzMO8qPsSpjP+jgLgCkDsQpZXiD2UTX6Q@mail.gmail.com>
Date: Sun, 14 Jul 2013 11:42:45 -0400
From: Craig Young <vuln-report@...ur3.us>
To: bugtraq@...urityfocus.com, webappsec@...urityfocus.com
Subject: [CVE-2012-6458] Multiple Persistent XSS in silverstripe-ecommerce

I am writing to inform you of multiple persistent XSS issues within
the ecommerce module
(https://code.google.com/p/silverstripe-ecommerce/) of SilverStripe
CMS.   These issues have been fixed without a corresponding release
note or other indication of a security advisory.  The author has been
unresponsive about what version numbers contain the fixes so I am
instead posting a link to the fix in case anyone wants to check/patch
their site.

https://code.google.com/p/silverstripe-ecommerce/source/detail?r=3739

Specifically there were some places where user-controlled profile
values were rendered without being sanitized.  This could be exploited
by an attacker who establishes an account using their victim's email
address or an attacker who gains access to their victim's account by
any other means.  In these situations the attacker could insert XSS
payloads which would execute if the victim subsequently logs into the
account.  The issue is tracked as CVE-2012-6458.

Thanks,
Craig Young
@CraigTweets