Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and...

6.8 CVSS

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to (a) ashop/catalogue.php and (b) ashop/basket.php, the (2) exp parameter to ashop/catalogue.php, the (3) searchstring parameter to (c) ashop/search.php, the (4) checkout and (5) action parameters to (d) ashop/shipping.php, the cat parameter to (f) cart-path/admin/editcatalogue.php, and the (7) resultpage parameter to (g) cart-path/admin/salesadmin.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-0056

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ashopsoftware

View All →

CVE-2008-3136

SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows...

High 7.5

Affected Vendor

ashopsoftware

View all reports →

Affected Software

ashop administration panel, ashop deluxe

Vulnerable Versions:

4.5

Timeline

Official Publish: January 4th, 2007

Last Modified: August 7th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.