1. Introduction
The Comersus Cart application contains multiple vulnerabilities, including SQL injection and cross-site scripting flaws. These issues can allow attackers to compromise sensitive data stored in the database or execute malicious code within a user’s browser. This affects websites using the Comersus Cart e-commerce platform. A successful exploit could lead to loss of confidentiality, integrity, and availability of website data.
2. Technical Explanation
- Root cause: Lack of input validation on user-supplied data.
- Exploit mechanism: Attackers inject SQL commands or script code through vulnerable parameters. For example, a crafted URL like
http://example.com/search.asp?q=could trigger cross-site scripting. - Scope: Comersus Cart application versions prior to the fix are affected.
3. Detection and Assessment
You can confirm vulnerability by checking the installed version of Comersus Cart and attempting to inject test payloads.
- Quick checks: Check the Comersus Cart version in the application’s “About” section or configuration files.
- Scanning: Nessus plugin ID 14183 and 14191 may detect these vulnerabilities, but results should be verified manually.
- Logs and evidence: Examine web server logs for suspicious SQL queries or JavaScript code in request parameters. Look for patterns like ‘SELECT’ statements or ‘