CVE-2005-4530 - Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Enterprise 3.0 (formerly DoPa

CVE-2005-4530

Summary

Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Enterprise 3.0 (formerly DoPays) allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters in (1) profile.htm, (2) card.htm, (3) bank.htm, (4) subscriptions.htm, (5) send.htm, (6) request.htm, (7) forgot.htm, (8) escrow.htm, (9) donations.htm, and (10) products.htm.

References

Vulnerable Configurations

cpe:2.3:a:alstrasoft:epay:3.0:*:pro:*:*:*:*:*
cpe:2.3:a:alstrasoft:epay:3.0:*:pro:*:*:*:*:*

CVSS

Base:	5.1 (as of 20-07-2017 - 01:29)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

bid	16055
misc	http://pridels0.blogspot.com/2005/12/alstrasoft-epay-enterprise-v30-xss.html
osvdb	21883 21884 21885 21886 21887 21888 21889 21890 21891 21892
secunia	18153
vupen	ADV-2005-3074
xf	alstrasoftepay-multiple-parameters-xss(23852)

Last major update

20-07-2017 - 01:29

Published

28-12-2005 - 01:03

Last modified

20-07-2017 - 01:29