Nessus Plugin #10836

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Agora CGI Cross Site Scripting

Family:

CGI abuses : XSS

Category:

attack

Copyright:

This script is Copyright (C) 2002 Matt Moore

Summary:

Tests for Agora CGI Cross Site Scripting

Version:

$Revision: 1.16 $

Cve_id:

CVE-2001-1199

Bugtraq_id:

3702

Xrefs:

-

Description:

Agora is a CGI based e-commerce package. Due to poor input validation,
Agora allows an attacker to execute cross-site scripting attacks.
For example:

http://www.example.com/store/agora.cgi?cart_id=<SCRIPT>alert(document.domain)</SCRIPT>&xm=on&product=HTML

Solution : At the time of writing this test, no solution was available
for this problem. However, a new version of Agora may become available
at http://www.agoracgi.com. Please check the Agora CGI web site or
contact your vendor for the latest version.

Risk factor : High