Vulnerabilities > CVE-2004-2411 - Unspecified vulnerability in Virtual Programming Vp-Asp 4.0/4.50/5.0

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
virtual-programming
exploit available
NVD
Published: 2004-12-31
Updated: 2024-11-20

Summary

The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attackers to conduct cross-site scripting (XSS) attacks that do not use <script> tags, as demonstrated via javascript in IMG tags to (1) the cat parameter in shopdisplayproducts.asp or (2) the msg parameter in shoperror.asp, and possibly other vectors.

Vulnerable Configurations

Part Description Count
Application
Virtual_Programming
3

Exploit-Db

descriptionVirtual Programming VP-ASP Shoperror Script 4/5 Cross-Site Scripting Vulnerability. CVE-2004-2411. Webapps exploit for asp platform
idEDB-ID:24198
last seen2016-02-02
modified2004-06-14
published2004-06-14
reporterThomas Ryan
sourcehttps://www.exploit-db.com/download/24198/
titleVirtual Programming VP-ASP Shoperror Script 4/5 - Cross-Site Scripting Vulnerability

References