Ravens PHP Scripts - osCommerce *page/zpage* Cross-Site Scripting Vulnerabilities

SECUNIA ADVISORY ID: SA22275

VERIFY ADVISORY: http://secunia.com/advisories/22275/

CRITICAL: Less critical

IMPACT: Cross Site Scripting

WHERE: >From remote

SOFTWARE: osCommerce 2.x - http://secunia.com/product/1308/

DESCRIPTION: Some vulnerabilities have been reported in osCommerce, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "page" parameter in multiple files and to the "zpage" parameter in admin/geo_zones.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in an administrator's browser session in context of an affected site. The vulnerabilities have been reported in osCommerce 2.2 Milestone 2 Update 060817. Other versions may also be affected.

Affected files:

admin/banner_manager.php
admin/banner_statistics.php
admin/countries.php
admin/currencies.php
admin/languages.php
admin/manufacturers.php
admin/newsletters.php
admin/orders_status.php
admin/products_attributes.php
admin/products_expected.php
admin/reviews.php
admin/specials.php
admin/stats_products_purchased.php
admin/stats_products_viewed.php
admin/tax_classes.php
admin/tax_rates.php
admin/zones.php

SOLUTION: Edit the source code to ensure that input is properly sanitised. Do not follow links from untrusted sources.

PROVIDED AND/OR DISCOVERED BY: Lostmon

ORIGINAL ADVISORY: http://lostmon.blogspot.com/2006/10/oscommerce-multiple-scripts-page-param.html