CVE-2010-1486
published 2010-04-22CVE-2010-1486: Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
1.20%
64.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the (1) billing address or (2) shipping address.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cactushop | cactushop | <= 6.1 | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
| cactushop | cactushop | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Possible CactuShop User Invoices Persistent XSS Attempt
suricata·2010-07-30
CVE-2010-1486 ET WEB_SPECIFIC_APPS Possible CactuShop User Invoices Persistent XSS Attempt
ET WEB_SPECIFIC_APPS Possible CactuShop User Invoices Persistent XSS Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible CactuShop User Invoices Persistent XSS Attempt"; flow:established,to_server; http.uri; content:"_invoice.asp"; nocase; content:"script>"; nocase; pcre:"/(alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)/i"; reference:url,www.coresecurity.com/content/cactushop-xss-persistent-vulnerability; reference:cve,2010-1486; classtype:web-application-attack; sid:2011054; rev:6; metadata:created_at 2010_07_30, cve CVE_2010_1486, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_10;)
No writeups or analysis indexed.
2010-04-22
Published