This host is running CubeCart and is prone to SQL injection and multiple cross-site scripting vulnerabilities.

Successful exploitation will let attackers to execute arbitrary HTML and script code in a user's browser session in context of an affected site and manipulate SQL queries by injecting arbitrary SQL code. Impact Level: Application.

Upgrade to CubeCart version 4.4.2 or later For updates refer to http://www.cubecart.com/tour

The flaws are due to - Input passed to the 'amount', 'cartId', 'email', 'transId', and 'transStatus' parameters in 'modules/gateway/WorldPay/return.php' is not properly sanitised before being returned to the user. - Input passed via the 'searchStr' parameter to index.php (when '_a' is set to 'viewCat') is not properly sanitised before being used in a SQL query.

CubeCart version 4.3.3

• http://secunia.com/advisories/41352
• http://www.acunetix.com/blog/web-security-zone/articles/sql-injection-xss-cubecart-4-3-3/
• http://www.securityfocus.com/archive/1/archive/1/513572/100/0/threaded

---

Updated on 2015-03-25